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Spoofing is a unique and growing threat from foreign 
actors targeting our veterans on social media in order to 
steal their voices, whether for spreading disinformation and 
political propaganda, luring unsuspecting Americans into 
romance scams, or simply engaging in commercial fraud, 
these predators are all trying to impersonate veterans or 
veteran service organizations. 
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- Chairman Mark Takano 
“Hijacking Our Heroes,” Nov. 13, 2019 
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EXECUTIVE SUMMARY 





THE THREAT OF FOREIGN INDIVIDUALS AND 
ORGANIZATIONS INFLUENCING UNITED STATES 
(U.S.) elections by manipulating social media has been a 
persistent and growing issue since before the 2016 election 
year. The threat was a significant concern during the 2020 
elections. 


MM 


WV 


Recent investigations and analysis document the broad 
proliferation of online influence campaigns that originate 
overseas. This includes the use of “spoofing,” or the act of 
disguising an electronic communication from an unknown 
source as being from a known, trusted source. A subset of 
these operations target the veteran and military service 
member communities in order to misappropriate their 
voices, authority and credibility. The pervasiveness of 
social media, as well as the nature of the specific threat to 
our election integrity and the sowing of political discord 
makes this a critical issue affecting both veterans and those 


MM 


WV 


who value veterans’ voices. As described by Chairman of 
the House Committee on Veterans’ Affairs, Mark Takano 
(D-CA), “the issue of protecting our elections from foreign 
influence is one of critical importance to all Americans 
and preserving the power of veterans’ voices should be of 
equal concern to us all.”' 


Veterans are Specifically Targeted for 
Spoofing 


ON WEDNESDAY, NOVEMBER 13, 2019, THE 
HOUSE COMMITTEE ON VETERANS’ AFFAIRS 
HELD an investigative hearing to examine the nature 
and scope of threats posed to the veterans’ community 
through “internet spoofing.” Experts testified that stolen, 
misappropriated, or fraudulently created social media 
accounts can be used to target veterans for the purposes 
of disseminating political propaganda and fake news in 
order to influence elections. The witnesses also described 
romance scams and commercial fraud being perpetrated 
using spoofing techniques. Representatives of three major 
social media _ platforms—Facebook, Instagram, and 
Twitter—discussed how they are addressing this threat, 
particularly considering the 2020 elections, and described 


MM 


WV 


best practices for information sharing, protective measures, 
and law enforcement cooperation. The Committee later held 
a briefing on January 14, 2020, with representatives from 
several components of the Federal Bureau of Investigation 
(FBI) that handle law enforcement for online crimes. 


Ranking Member Dr. David P. Roe (R-TN) noted during 
the hearing, “The evidence is clear that veterans have their 
identity misappropriated and that they, like other social 
media users, could be targets for propaganda or scams.” 
Although everyone who uses the internet is subject to 
online scams, spamming, phishing, identity theft, and other 
such risks, veterans are particularly susceptible to internet 
spoofing based on their higher propensity for political 
engagement (including running for office, volunteering, 
and sharing political opinions and information).° For the 
purposes of disseminating political propaganda or exerting 
influence on dividing Americans on sensitive political 
“wedge issues,” veterans are targeted because of their 
close identification with strong national security policies, 


1 Hijacking Our Heroes: Exploiting Veterans through Disinformation on Social Media Before the H. Comm. On Veterans’ Affairs, 116th Cong. at 5 (2019) (hearing transcript) [hereinatter HVAC Committee 


Hearing Transcript). 
2 Id. at 9. 


3 JOHN D. GALLACHER, VLAD BARASH, PHILIP N. HOWARD & JOHN KELLY, COMPUTATIONAL PROPAGANDA RESEARCH PROJECT, JUNK NEWS ON MILITARY AFFAIRS AND NATIONAL 
SECURITY: SOCIAL MEDIA DISINFORMATION CAMPAIGNS AGAINST US MILITARY PERSONNEL AND VETERANS at 1 (2017), 


http: //comprop.oii.ox.ac.uk/research/working-papers/vetops/. 
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patriotism, personal sacrifice, and honor.* Chairman _ its information operations after the 2016 U.S. Presidential 
Takano stated during the hearing, “By impersonating — elections, both in terms of volume and intensity. Russia and 
veterans, these foreign actors are effectively eroding the Iran are the most prominent state actors in this context, but 
2 recent work has identified additional state actors, such as 

China and Saudi Arabia, using information operations to 


hard-earned power and integrity of veterans’ voices. 


Veterans are more likely to be engaged intheir communities, target communities and topics of interests. 

be perceived as leaders, and can exert influence on political 

matters (particularly with respect to defense and national The Senate Select Committee on Intelligence published a 
security matters).° Therefore, a successful spoofing scam __five-volume bipartisan report focused on Russia’s influence 
that results in a veteran or Veteran Service Organization operations. The second volume focused on Russia’s use 
(VSO) unknowingly distributing or endorsing a piece of of social media platforms to influence the election, while 
disinformation can yield greatly increased, and sometimes _ the third volume focused on the shortcomings of Obama 
even exponential, results due to the added credibility Administration efforts to combat the ongoing attacks. The 
imparted to that disinformation by virtue of its approval — third volume highlighted the lack of legislative or regulatory 
by the veteran or VSO. With each successive endorsement action to combat a known threat emanating from Russia 
or share, the credibility of the disinformation snowballs. and its intelligence services. The Senate Report sheds light 
The collective association with actual veterans and VSOs__ on the broader issues of misinformation campaigns and 
makes it increasingly unlikely that the disinformation willbe predatory schemes targeting veterans presented in a report 
closely scrutinized, questioned, or eventually exposed as__ prepared by the Vietnam Veterans of America (VVA). 
fraudulent or misleading. Moreover, scammers also try to 
spoof veterans to gain leverage over them. Many veterans 
move into jobs requiring security clearances or within the 
federal government after they leave the military — those 
positions can be jeopardized if the veteran is compromised 
through financial fraud, identity theft, or otherwise becomes 
susceptible to blackmail.’ 


Action by Law Enforcement and Social 
Media Platforms Is Inadequate 


INDUSTRY ANALYSTS, JOURNALISTS, AND LAW 
ENFORCEMENT AGREE THAT THE PROBLEMS OF 
internet spoofing and foreign influence exerted through 
social media continue to grow at an alarming pace. 
However, neither the major platforms nor the FBI were 
able to identify an obvious or comprehensive solution to 
this ongoing problem. Both continue to devote significant 
INTERNET SPOOFING BECAME A _ VISIBLE resources towards combatting spoofing. However, the 
PROBLEM IN THE CONTEXT OF THE 2016 U.S. foreign entities who perpetrate much of this illicit activity 
election, when foreign disinformation spread widely across are becoming more sophisticated in their schemes and are 
social media, including Facebook, Instagram, Twitter and targeting broader swaths of internet users to more quickly 
YouTube, among others. However, disinformation on and efficiently disseminate their fraudulent messaging 
social media and information operations conducted by _ before they are identified and deactivated. 

sophisticated actors have occurred for far longer. In the past 

few years, foreign information operations have targeted Facebook and Twitter note that automated systems can 
divisive political issues within American society and have _ struggle to differentiate authentic images and accounts 
sought to manipulate and divide political and social from fraudulent, unauthorized, or duplicated accounts and 
communities. Unfortunately, our military and veterans’ thereby risk erroneously flagging and removing legitimate 
communities are no exception. Moreover, the incidents of accounts. The platforms have chosen to err on the side 
foreign spoofing increased following the 2016 election, of minimizing false negatives by relying upon patterns 
and industry experts project that these numbers will of suspicious activity and certain tactics or techniques, 
continue to increase through 2020 and beyond. Russia’s rather than on other identifying data (e.g., duplicative 
Internet Research Agency (IRA), a Russian company names or images, geolocation information, or ostensible 
which has engaged in online influence operations, more organizational affiliations). Suspicious activity patterns, 
commonly known as a “troll farm,” dramatically expanded such as irregular, repetitive, or voluminous posting, triggers 


Spoofing of Veterans Threaten U.S. 
Elections 


Ald 

5 HVAC Committee Hearing Transcript, at 4. 

6 GALLACHER ET AL., COMPUTATIONAL PROPAGANDA RESEARCH PROJECT, JUNK NEWS ON MILITARY AFFAIRS AND NATIONAL SECURITY: SOCIAL MEDIA DISINFORMATION CAMPAIGNS AGAINST US MILITARY 
PERSONNEL AND VETERANS at 1 (2017), http://comprop.oii.ox.ac.uk/research/working-papers/vetops/. 

7 KRISTOFER GOLDSMITH, VIETNAM VETERANS OF AMERICA, AN INVESTIGATION INTO FOREIGN ENTITIES WHO ARE TARGETING SERVICEMEMBERS AND VETERANS ONIINE at 12-13 (2019), https://wa.org/wp-content/ 
uploads/2019/09/VVA-Investigation.pdf [hereinafter VVA REPORT]. 
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additional layers of review, including an examination 
of the geolocation data in order to assess where the 
suspicious activity may be originating. The final review and 
removal decisions sometimes warrant human examination, 
but often removals are made without any human review. 
Although these layered review processes may be effective 
in protecting legitimate users, they undoubtedly also add 
a significant gap in removal time for fraudulent accounts, 
which provides a window within which spoofers can 
continue to operate. 


Law enforcement agencies, such as the FBI, are constrained 
in their abilities to efficiently identify and eliminate spoofers 
because the agencies only have limited access to the data 
held by the social media platforms. Often these agencies do 
not receive important information until after the platforms 
have already removed a spoofed account, at which point 
law enforcement is unable to actively monitor and trace the 
account in real time. 


The ability of spoofers to operate from overseas, 
anonymously, or by using fraudulent or concealed 
identities requires law enforcement to rely upon account 
identification data and detailed activity patterns in order 
to accurately identify or locate the potential spoofer. 
However, Title II of the Electronic Communications Privacy 
Act (ECPA) (18 U.S.C. §§ 2701-2713), known as the 
Stored Communications Act, requires a government entity 
to serve a subpoena on social media platforms to compel 
the production of certain relevant information. Requiring a 
time-consuming legal process to obtain identification data 
hampers the ability of law enforcement to respond quickly 
or to fully understand the scope of a potential spoofing 
campaign. Therefore, the law enforcement agencies 
recommend increasing the amount and level of detail that 
the platforms can easily provide to the authorities. 


Past attempts to address this problem have been 
piecemeal in nature and have proven ineffective to date. 
This fragmented approach has prevented any wholesale, 
systemic efforts to tighten rules or law enforcement 
protocols. Incremental adjustments have been made by 
individual platforms, which leaves an irregular landscape 
where motivated, corrupt actors may still be able to exploit 
weaknesses among the platforms. 


The Federal Government and the Social Media Platforms 
Should Take Additional Action Based on discussions with 
representatives of law enforcement, and considering the 
issues raised by the social media platforms during the 
hearing, the Committee believes that there are additional 
measures needed to address the growing threats posed by 
spoofing. 


Past attempts to address this problem have 


been piecemeal in nature and have proven 
ineffective to date. 





Recommendations 


RECOMMENDATIONS FALL INTO TWO BROAD 
CATEGORIES. 


The first category is oriented at users of social media and 
is defensive in nature, such as teaching users how to be 
aware of the dangers posed by spoofers on social media 
and training them how to protect themselves through 
heightened vigilance, healthy skepticism, and adherence 
to basic principles of cyber-hygiene. 


1. Improve Awareness through a Public Service 
Announcement Campaign 

2. Develop Cyber-hygiene Training 

3. Strengthen Partnership Between Social Media 
Platforms and VSOs 


The second category is aimed at putting the social media 
platforms and law enforcement on the offensive and 
developing robust mechanisms to more effectively identify 
and quickly eliminate foreign-based spoofers. While 
the first category is likely to be less costly and easier to 
implement, the second category may ultimately prove to 
be more effective in bringing the threat under control. 


4. Improve Reviews of Accounts by Social Media 
Platforms 

Oi Consider Legislative Reforms to Facilitate Sharing 
Information 

6. Increase Data Sharing on Fraudulent Accounts 

di Improve Identity Verification and Geolocation 


Identification 
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INTRODUCTION io SPOOFING 





VETERANS AND THE VETERANS’ COMMUNITY 


HAVE CONSISTENTLY BEEN TARGETED BY 
scammers and malicious actors seeking to exploit their 
valor, prestige, and assets. Since the advent of the internet, 
new types of risks for scams, misinformation, and fraud 
have become prevalent. Spoofing now represents the latest 
tactic used by bad actors to try and target veterans and 
their supporters. 


What is Spoofing? 


IN ITS SIMPLEST TERMS, “SPOOFING” IS 
THE ACT OF DISGUISING AN’ ELECTRONIC 
COMMUNICATION from an unknown source as 
being from a known, trusted source — either by creating 
a fraudulent account, or by hijacking a real account.® 
Websites, Facebook pages, Twitter accounts, and 
other social media can all be spoofed by bad actors 
seeking to deceive or trick unsuspecting viewers and 
are referred to as spoofed websites, spoofed pages, 
or spoofed accounts. While all users of the internet 
are generally subject to the potential risks of fraud, 
deception, and theft, spoofing on social media is often 
specifically targeted at particular groups or types of 
users. This includes, notably, veterans. Veterans and 
VSOs are being targeted for internet spoofing scams, 
in which social media accounts and online profiles are 
being stolen, hijacked, fraudulently created, copied, or 
otherwise faked to misappropriate veterans’ identities, 
voices, images, and affiliations.’ 


In its simplest terms, ‘spoofing’ is the act of 
disguising an electronic communication from 


an unknown source as being from a known, 
trusted source - either by creating a fraudulent 
account, or by hijacking a real account 





Internet spoofing can take many different forms and be 
deployed for a wide range of nefarious behavior with 
significant and damaging results to individual veterans 


and their families, and even to our national security and 
election integrity. Much, but not all, of this fraudulent 
online activity is perpetrated by foreign actors, and 
even in some cases, by state-backed foreign actors.'° 
Through such_ online 
images, identities, and voices are being illicitly used 
to influence our elections by disseminating political 
propaganda, disinformation and fake news. Spoofers 
also misappropriate veterans’ images and stories in 
order to conduct romance scams and engage in various 
other forms of commercial fraud." 


misappropriation, veterans’ 


Spoofed accounts can often be identified by certain 
patterns of posting activity, growth rates of the follower 
and subscriber base, or signs of foreign control. 
Kristofer Goldsmith, the Founder and President of High 
Grounds Veterans Advocacy, and the former Associate 
Director of Policy & Government Affairs for the Vietnam 
Veterans of America (VVA), a congressionally chartered 
VSO, conducted an investigation into spoofing after 
discovering that VVA itself had been spoofed. Through 
the course of investigating the VVA spoof, VVA learned 
that many spoofed websites commonly feature high 
numbers of followers or subscribers, irregular, repetitive, 
or voluminous posting activity, and often have foreign- 
based administrators. Goldsmith provides the following 
example in the VVA report: 


One such page, “Veterans of Vietnam,” with nearly 160,000 
followers, has had admins in Russia, Ukraine, and Italy. This 
page has been bolstered by at least three dedicated Russian- 
generated Vietnam-veteran focused websites that were 
created to build the Facebook page’s credibility by sharing 
information about the Vietnam War and veterans’ benefits. 
These admins also control a closed Facebook group, “American 
Veterans of Vietnam,” which solicits information from Vietnam 
veterans regarding their military experience. Fake accounts 
are also being utilized by hostile Chinese intelligence services 
to connect with high-ranking and influential members of the 
intelligence and defense communities centered in and around 
Washington, DC. Chinese officials are seeking to exploit 
financially vulnerable members of these communities and 
leverage debts to recruit spies.” 


8 Alex Horton, Russian Trolls Are Targeting American Veterans, and Trump's Government Isn't Helping, Group Says, THE WASHINGTON POST (Jan. 7 2020), https://www.washingtonpost.com/national-security/2020/01 /O7 /russian- 


trolls-are-targeting-american-veterans-trumps-government-isnt-helping-group-says/. 


9 There are four different types of Veteran Service Organizations: (1) Congressionally chartered Veterans Service Organizations that are also recognized by the Department of VA Office of General Counsel for the purpose of preparation, 
presentation, and prosecution of claims under laws administered by the Department of Veterans Affairs, as provided in Section 5902 (formerly Section 3402) of Title 38, United States Code (U.S.C.} and Sub Section 14.628(a) and (c) 

of 38 C.ER., (2) Congressionally chartered Veterans Service Organizations but that are NOT recognized by the Department of Veterans Affairs for the purpose of preparation, presentation and prosecution of Veteran's claims only, (3) 
Veteran organizations NOT congressionally chartered but are officially recognized by the Department of Veterans Affairs for the purpose of preparation, presentation and prosecution of Veteran's claims only, and (4) Veteran organizations 
not congressionally chartered or officially recognized by the Department of Veterans Affairs for the purpose of preparation, presentation and prosecution of Veteran's claims only. Additionally, there are VSOs that are categorized as 
Intergovernmental Affairs organizations. See generally U.S. DEP’T OF VETERANS AFFAIRS, VETERANS AND MILITARY SERVICE ORGANIZATIONS AND STATE DIRECTORS OF VETERANS AFFAIRS (2019), available at https: //www. 


va.gov/vso/VSO-Directory.pdf. 
10S. Rep. No. 116-XX, Volume 2 at 11 (2019). 


11 Darla Mercado, These Scammers Have Set Their Sights on Members of the Military, CNBC (Nov. 13, 2019), httos://www.cnbc.com/2019/ 11 /13 /these-scammers-have-ripped-off-405-million-from-members-of-the-military.html. 


12. GOLDSMITH, VVA REPORT, at 137. 
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Spoofing on social media platforms can be as simple as 
creating a social media account using a name, image, 
or affiliation that is not owned by or authorized for the 
creator. Spoofing does not require “hacking” an existing 
account or gaining access to a password. Instead, 
spoofing generally involves the creation of a new 
account that fraudulently purports to be the account of an 
individual or entity with which it has no actual connection. 
These fake sites then rapidly build up a dedicated 
following by disseminating carefully curated memes 
(captioned pictures, GIFs, or videos, often altered to be 
humorous, that are copied and spread online in a viral 
manner),’° images, propaganda, and fake or modified 
news stories, all of which are deliberately designed 
to provoke an emotional response from a targeted 
group, accompanied by sharing, liking, endorsing, and 
following the fake group and its content.* This content 
often involves copying publicly available images, 
recycling old news stories with minor modifications or 
repurposing outdated stories to leverage the changed 
circumstances to dupe unsuspecting readers. Spoofers 
deliberately leverage emotionally sensitive topics, 
often involving politics or divisive social issues, by using 
simplistic memes or manipulative images to elicit a strong 
reaction and reflexive “like” or “share.” 


Social media platforms are generally ill- 


equipped to determine whether a given image 
or association is authentic or authorized, so 


when a duplicative account is brought to their 
attention, it is not readily apparent which 
eto Mi Mateo Rolie M iC e eR Rie) Com 





How is Spoofing Detected? 


INTERNET SPOOFING MUST BE DETECTED BY 
EXAMINING REPEATED PATTERNS OF SUSPICIOUS 
account activity or online behavior, as opposed to a simple 
inspection of the names, images, or purported identities 
associated with a given account. Social media platforms 
are generally ill-equipped to determine whether a given 
image or association is authentic or authorized, so when 
a duplicative account is brought to their attention, it is not 
readily apparent which account is the real one and which 


Merriam-Webster, Meme Definition, https: //www.merriam-webster.com/dictionary/meme. 
GOLDSMITH, VVA REPORT, at 25. 
Id. 


GOLDSMITH, VVA REPORT, at 14. 
Id. 


is the fake. The use of stock photographs, celebrity images, 
sports team logos, and alternative spelling/nicknames 
further complicates the ability of a social media platform to 
identify fraudulent or misappropriated accounts efficiently 
or accurately based solely on the identifying criteria 
associated with the account. Moreover, many users may 
have multiple accounts on each social media platform 
for legitimate purposes, such as separating personal and 
professional accounts, or maintaining independent family 
and personal accounts. A simple review of basic account 
information is insufficient to enable the social media 
platform to reliably make any determinations about which 
of these accounts were legitimate. Therefore, the platforms 
examine account behavior and patterns of activity to 
identify potentially suspicious trends which may indicate a 
spoofed or fraudulent account. 


Using automatic machine review and artificial intelligence to 
rapidly analyze large volumes of internet traffic enables the 
platform to identify patterns of account activity that do not 
fit within projected norms of standard behavior. Examples 
of these patterns include posting at unusual rates, times, or 
volumes, repeated posting or sharing of the same content, 
or near instantaneous posting or commenting on particular 
pages that may indicate automated posting, often referred 
to as “bot activity.”'° Some specific types of signals that 
may indicate “suspicious activity” include coordinated 
inauthentic behavior such as posting identical content 
on different platforms or pages nearly simultaneously; 
spelling and grammatical mistakes potentially indicative 
of non-native English speakers; distributing URLs that are 
associated with malware; masking the actual identity of links 
by using URL-shorteners; soliciting personal information; 
the use of advertising tools to target and retarget specific 
users (such as veterans); and the use of duplicative images, 
memes, or links across multiple accounts and platforms. 
Suspicious activity can also include the dissemination of 
foreign-state-sponsored and state-controlled propaganda 
from known sources such as TASS, RT, and Sputnik News.” 
Other indicia of suspicious activity may include altering 
names and themes of pages and groups related to 
veterans, and the false representation of veteran status or 


VSO affiliation.'® 


The platforms regularly use a combination of human 
reviewers and artificial intelligence to screen and review 
content for certain violations, such as pornography, violent 
images, and some intellectual property violations. The 


3 
4 
5 
6 Abotis a computer program that performs automatic repetitive tasks. Merriam-Webster, Bot Definition, https://www.merriam-webster.com/dictionary/bot. 
/ 
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specific nature of the questionable content in spoofing 
makes it particularly challenging for artificial intelligence 
alone to identify and verify material from fraudulent 
accounts. Similarly, human fact-checkers can screen 
factual disinformation, but can struggle to independently 
and efficiently verify photographs or associated identities, 
among others. By supplementing human review with 
artificial intelligence, the platforms have had some success 
in detecting behaviors that are difficult for bad actors to 
fake, including connections to others on the platform. 
For example, in December 2019, Facebook removed 
hundreds of accounts across all of its platforms, including 
Instagram, that were associated with a group that had 
used Al-generated profile pictures to pose as real people 
and then spread misinformation through the resulting 
artificially-expanded networks.” This marked the first 
reported instance that Al-generated user profiles launched 
at scale and used in an influence operation social media 
campaign were identified and removed.”° Twitter also 
removed hundreds of fraudulent accounts generated by 
the same group as part of a coordinated global spoofing 
campaign.”! 


Cheapfakes and Deepfakes 


THE CHALLENGE OF DISINFORMATION _ IS 
MAGNIFIED WHEN ACCOUNTS POST MATERIALS 
that do not objectively violate the terms of service, but 
instead make false claims or distribute doctored media, 
including “cheapfake” or “deepfake” videos, or create 
accounts using pictures generated by artificial intelligence 
in order to quickly and surreptitiously build a massive 
global network. 


Cheapfakes use conventional techniques like speeding, 
slowing, cutting, re-staging, or 
footage to alter how the media is widely perceived.” 
The use of photoshopping and lookalikes are common 
cheapfake methods used to create doctored images to 
circulate through the media. An easy mode of producing 
a cheapfake is simply cutting together existing footage, 
speeding up or slowing down that footage, or altering 
the audio and spreading it under false pretenses. This 


re-contextualizing 


threat looms large because cheapfakes are easy to make 
and distribute through powerful social media platforms 
designed to spread engaging content widely and quickly. 


The challenge of disinformation is magnified 
when accounts post materials that do not 


objectively violate the terms of service, 
but instead make false claims or distribute 
doctored media. 





Deepfake media content, on the other hand, is audio or 
video that has been fabricated with very sophisticated 
tools to make someone appear to say or do something they 
did not really do — from harmless satire to propaganda 
— and are increasingly difficult to differentiate from 
legitimate media.*? Doctored cheapfake clips have been 
used for decades to distort viewers’ reactions, including a 
slowed video showing LAPD officers beating Rodney King 
that was used by the officers’ defense counsel during their 
1993 trial in order to sow doubt with the jury, to a more 
recent May 2019 example, when a manipulated video clip 
was decreased in speed by almost 75% in order to depict 
Nancy Pelosi “drunkenly” slurring her words while talking 
about Donald Trump.” The video of Speaker Pelosi was 
altered to give the impression that her speech was sluggish, 
suggesting perhaps that she had a mental ailment or that 
she was drunk.”° This video had more than 11 million views 
in just five days. Notably, YouTube removed this video 
from its platform as a violation of its policy on technical 
manipulation of videos.”° Twitter did not remove the video 
immediately, and did not comment to explain its decision.”” 
Facebook declined to remove the video, even after its third- 
party fact-checking partners deemed the video to be false, 
stating instead, “ We don’t have a policy that stipulates that 
the information you post on Facebook must be true.””° 


Each of these technical tool sets was previously only 
available to experts, but with technological advancement 
and widespread social media use, these are more accessible 
to amateurs and their outputs reach larger scales at higher 
speeds. Today, social media is experiencing a rapid 
increase of image and video distribution and redistribution. 


19 Tony Romm & Isaac Stanley-Becker, Facebook, Twitter Disable Sprawling Inauthentic Operation that Used Al to Make Fake Faces, THE WASHINGTON POST (Dec. 20, 2019), https://www.washingtonpost.com/ 


technology/2019/ 12/20/facebook-twitter-disable-sprawling-inauthentic-operation-that-used-ai-make-fake-faces/. 
20 Id. 
Z) id. 


22 BRITT PARIS &JOAN DONOVAN, DATA & SOCIETY, DEEPFAKES AND CHEAP FAKES: THE MANIPULATION OF AUDIO AND VISUAL EVIDENCE 23-32 (2019), https: //datasociety.net/wp-content/uploads/2019/09/DS_ 


Deeptakes_Cheap_FakesFinal-1-1.odf [hereinafter DEEPFAKES & CHEAP FAKES]. 


23 Drew Harwell, Top Al Researchers Race to Detect ‘Deeptake’ Videos: ‘We Are Outgunned’, THE WASHINGTON POST (June 12, 2019), httos://www.washingtonpost.com/technology/2019/06/ 12 /top-ai-researchers-race-detect- 


deepfake-videos-we-are-outgunned/. 
24 PARIS & DONOVAN, DEEPFAKES & CHEAP FAKES, at 30. 





25 Drew Harwell, Faked Pelosi Videos, Slowed to Make Her Appear Drunk, Spread Across Social Media, THE WASHINGTON POST (May 24, 2019), https://www.washingtonpost.com/technology/2019/05/23/taked-pelosi-videos- 


slowed-make-her-appear-drunk-spread-across-social-media/. 


26 Greg Bensinger, As Primary Season Gets Underway, YouTube Cracks Down on Doctored Election Videos, THE WASHINGTON POST (Feb. 3, 2020), https: //www.washingtonpost.com/technology/2020/02/03/youtube-election- 


videos/. 


27 Drew Harwell, Facebook Acknowledges Pelosi Video Is Faked but Declines to Delete It, THE WASHINGTON POST (May 24, 2019), https://www.washingtonpost.com/technology/2019/05 /24/tacebook-acknowledges-pelosi- 


video-is-faked-declines-delete-it/. 


28 Id. 
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Members of the public have the ability to spread messages 
at a larger scale, with less oversight than ever before. 


Each of these technical tool sets was previously only 
available to experts, but with technological advancement 
and widespread social media use, these are more accessible 
to amateurs and their outputs reach larger scales at higher 
speeds. Today, social media is experiencing a rapid 
increase of image and video distribution and redistribution. 
Members of the public have the ability to spread messages 
at a larger scale, with less oversight than ever before. 


For example, deepfake technology has already been 
deployed in India’s 2020 elections. There, a candidate 
recorded a video in English and then used deepfake 
technology to change his speech and the specific movement 
of his mouth to make it appear that he was speaking in 
Hindi in a strategic effort to solicit Hindi-speaking voters.”” 
While this use was not necessarily for nefarious purposes, 
the growing ease of creating such convincing videos 
demonstrates the imminent risks and dangers that are on 
the doorstep. Acknowledging the imminent threat posed 
by deepfakes and manipulated videos, YouTube - the 
largest purveyor of video content and the world’s second 
largest search engine - has announced a policy banning 
technically manipulated or doctored content that may 
mislead viewers.°° This policy excludes video clips simply 
taken out of context without further manipulation. Twitter 
also has a policy prohibiting synthetic and manipulated 
media, including deepfakes and cheapfakes.*' Facebook 
has implemented a similar policy, but with significant 
exclusions as discussed below.*” 


Today, social media is experiencing a rapid 
increase of image and video distribution and 


redistribution. Members of the public have 
the ability to spread messages at a larger 
scale, with less oversight than ever before. 





Deepfake technology poses two parallel sets of problems. 
First, deepfake technology could in the future be capable 
of producing fraudulent content of such high quality that 


current detection methods will be unable to evaluate the 
legitimacy of the material.*? Second, as deepfake media 
becomes more interspersed with authentic media, more 
people will tend to ignore or dismiss legitimate news. 
This is particularly dangerous for the veteran population 
whose aging demographic may be less familiar with newer 
technology than younger groups.** 


Compounding the emerging threat posed by cheapfakes 
and deepfakes are the particular definitions of 
“manipulated video” used by platforms to establish and 
regulate their own content standards and community 
guidelines. For example, Facebook's policy banning 
manipulated video requires both 1) that the video be edited, 
synthesized, and likely to mislead, and 2) that the video 
be the product of artificial intelligence, machine learning, 
or deep learning, that merges, combines, replaces, and/ 
or superimposes content onto a video, creating a video 
that appears authentic.°? Moreover, and perhaps most 
troubling, Facebook’s policy also excludes content that has 
been edited to omit words that were said or change the 
order of words that were said.°*° Selectively removing or 
resequencing words can obviously lead to fundamentally 
different meanings than what the speaker intended, and 
so it is unclear how or why this exclusion is consistent 
with Facebook’s stated objective of reducing misleading 
content. Even beyond spoken words, Facebook has also 
allowed content that splices and reorganizes actions 
in a video to deliberately portray a different sequence 
of events than what actually occurred. For example, a 
cheapfake video involving Speaker Nancy Pelosi was 
shared widely following the State of the Union address on 
February 4, 2020. This cheapfake was strategically edited 
to juxtapose her ripping up the President’s speech with his 
comments recognizing veterans and a redeployed soldier 
reuniting with the soldier’s family, when in reality she had 
torn up the speech after the President had concluded his 
remarks.°” This video was shared to allude that the Speaker 
was disrespecting veterans and the central issues faced 
by veterans. This type of misinformation parallels other 
schemes which use veterans and veteran issues as wedges 
to deepen the divide between political parties and paint 
one party or the other as “anti-veteran.” 


29 Charlotte Jee, An Indian Politician Is Using Deeptake Technology to Win New Voters, MIT TECHNOLOGY REVIEW (Feb. 19, 2020), https://www.technologyreview.com/t/615247 /an-indian-politician-is-using-deeptakes-to-try-and- 


win-voters/. 


30 Leslie Miller, How YouTube Supports Elections, YOUTUBE: OFFICIAL BLOG (Feb. 3, 2020) (Miller is the VP of Government Affairs and Public Policy), https: //youtube.googleblog.com/2020/02 /how-youtube-supports-elections.html. 


31 Twitter, Synthetic and Manipulated Media Policy, https: //help.twitter.com/en/rules-and-policies/manipulated-media 


32 Facebook, Manipulated Media Policy, https://www.facebook.com/communitystandards/manipulated_media. 


33 A study conducted by Deeptrace, an Amsterdam-based cybersecurity company, revealed that in 2019 there were approximately 15,000 deepfake videos, nearly double the amount online 2018. Of these 15,000 videos 96 percent 
were pornographic in nature and the top four most visited deepfake pornography websites had over 134 million views. Additionally, the report found that a marketplace for deepfake creators to sell their services has cropped up - selling 
services, including "bespoke faceswap videos for $30 to custom voice cloning for $10 per 50 words generated.” HENRY AJDER, GIORGIO PATRINI, FRANCESCO CAVALLI & LAURENCE CULLEN, DEEPTRACE, THE STATE OF DEEPFAKES: 


LANDSCAPE, THREATS, AND IMPACT (2019), https: //regmedia.co.uk/2019/ 10/08/deeptake_report.pdf. 


34 David Frank, Veterans Twice as Likely to Be Scammed, AARP: SCAMS & FRAUD (Nov. 8, 2017}, https://www.aarp.org/money/scams-fraud /info-2017 /veterans-scam-protection-fd.html. 


35 Facebook, Manipulated Media Policy, https://www.facebook.com/communitystandards/manipulated_media. 
36 Id. 


37 Queenie Wong, Facebook, Twitter Called on to Ax Edited Clip of Pelosi Tearing Trump Speech, CNET (Feb. 7, 2020), https://www.cnet.com/news/facebook-twitter-under-pressure-to-remove-edited-video-of-pelosi-ripping-up-trumps- 
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Spoofing should be differentiated from stealing or hijacking 
control of a legitimate account. Spoofing is predicated upon 
fraud, such that the victim mistakenly believes the spoofed 
account to belong to a person or organization, but which 
actually has no connection to that known entity. Stolen or 
hijacked accounts, on the other hand, are the authentic 
accounts of the named person or organization, which 
are being controlled by an unauthorized person, without 
the knowledge or permission of the legitimate owner. 
Therefore, many of the standard cyber-security protocols 
intended to protect internet users from phishing,*? data 
breaches, and compromised accounts are not as effective 
in the spoofing context, although educating users to the 
importance of safeguarding personal data and being 
cautious when entering into any financial transactions 
is always valuable. While spoofing or impersonation is 
broadly against the Terms of Service for the major social 
network platforms, it is unclear whether simple spoofing, 
short of any commercial or financial fraud, is illegal. Once 
a spoofed account is used to perpetrate financial fraud 
(including romance scams) it most likely falls under federal 
criminal wire fraud statutes.°? 


Spoofing affects veterans in two distinct 
ways - veterans can be harmed by spoofing 
either when they are specifically targeted as 


the direct victims of spoofing, or when they 
are exploited by spoofers to specifically 
target a different, often non-veteran, victim. 





How Spoofing Affects Veterans 


WHILE ANYONE USING THE INTERNET IS SUBJECT 
TO THE RISKS OF SPOOFING, THE VETERANS’ 
community is particularly targeted and exploited by 
these scammers as previously discussed. Spoofing affects 
veterans in two distinct ways — veterans can be harmed 
by spoofing either when they are specifically targeted as 
the direct victims of spoofing, or when they are exploited 
by spoofers to specifically target a different, often 
non-veteran, victim. The former category includes the 
dissemination of political propaganda and fake news 
through spoofed accounts pretending to be veteran or VSO 
accounts with the specific intent of leveraging the influence 
and authority gleaned from that false affiliation. The latter 
category includes the perpetration of romance scams 


and other forms of commercial fraud where the targeted 
victim is not necessarily a veteran, but where the targeted 
victims incorrectly believe themselves to be interacting 
with an actual veteran or VSO. In both cases, the intended 
victims are targeted through the misuse of images, memes, 
fake news stories, and other disinformation transmitted 
via misappropriated, stolen, or fraudulent social media 
accounts. 


A common element of these types of spoofing schemes is the 
misappropriation of veterans’ voices to gain public trust. As 
Chairman Takano stated, “Pretending to be a veteran for 
any reason is shameful, but it is especially shameful when 
such deception is used to spread disinformation.” *° 


Veterans are also targeted because they can be particularly 
susceptible to blackmail or financial leverage if their 
personal information is compromised through a spoofing 
campaign. Many veterans continue to work in positions 
involving national security or otherwise requiring a security 
clearance, and any ability by a spoofer to compromise that 
security clearance would directly jeopardize the veteran's 
employment.*’ For example, if a veteran becomes 
ensnared in a romance scam that results in the veteran’s 
identity being stolen or their credit ruined, then their 
security clearance may be revoked, and they could lose 
their job. The VVA report noted, “Additionally, nearly one- 
third of the federal workforce is composed of veterans. This 
makes the targeting of the military and veteran population 
a means to jeopardize federal agencies ranging from law 
enforcement and defense to healthcare and food safety.” *” 


Pretending to be a veteran for any reason 
is shameful, but it is especially shameful 


when such deception is used to spread 
disinformation. 
- Chairman Mark Takano 





Political Propaganda & Disinformation 


VETERANS CARRY SIGNIFICANT CREDIBILITY AND 
INFLUENCE IN THEIR COMMUNITIES, ESPECIALLY 
on issues related to patriotism, national security, defense, 
and public service. Chairman Takano stated during the 
hearing, “Veterans wield considerable influence and 
credibility in their communities earned by virtue of their 


38 Phishing is a scam by which an Internet user is duped (as by a deceptive e-mail message) into revealing personal or confidential information which the scammer can use illicitly. Merriam-Webster, Phishing Definition, httos://www.merriam- 


webster.com/dictionary/ phishing. 

39 18 U.S.C. 8 1343. 

4Q HVAC Committee Hearing Transcript, at 4. 
Al GOLDSMITH, VVA REPORT, at 12. 

42 ld. 
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selfless sacrifice and service to our country. 
attempting to spread disinformation or fake news can 
leverage that credibility to amplify their messages by 
posing as veterans. The VVA report states, “Foreign 
adversaries have many motivations for targeting members 
of the military and veteran community. This population has 
a higher propensity than other subgroups of Americans 
to be politically engaged — they are more likely to vote 
and serve in public office — and they tend to wield greater 
political influence on those around them.”*4 Assuming 
the identity of a VSO or an individual veteran imparts a 
degree of reliability or authority to articles or news stories 
relating to those issues, which in turn makes that story more 
likely to be further shared. Increasing the number of “likes” 
on social media and spreading the story broadly through 
repeated sharing are the twin pillars of disseminating fake 
news and political propaganda. 


The content to which spoofers generally attempt to affix 
the misappropriated veteran endorsement includes socio- 
politically divisive issues predicated upon categorizing 
veterans, military, law enforcement, and “patriots,” 
defined broadly, on one side, and thereby positioning the 
“others” on the opposite side as necessarily unpatriotic, 
un-American, or at best, soft on crime or national defense. 
For example, issues like immigration policy, Black Lives 
Matter, or kneeling during the national anthem have all 
been used to target veterans and their associates such as 
families, friends, supporters, and affinity groups. Research 
conducted at the University of Washington concluded 
“that the examined trolling accounts systematically took 
advantage of these divisions,” and specifically focused on 
the hashtag BlackLivesMatter.*° 


‘Veterans wield considerable influence and 
credibility in their communities earned by 
virtue of their selfless sacrifice and service to 


our country.’ Spoofers attempting to spread 
disinformation or fake news can leverage 
that credibility to amplify their messages by 
posing as veterans. 





Using veteran affiliated pages, or pages that appear to 
have such affiliations, to spread memes and images that 


43 HVAC Committee Hearing Transcript, at 4. 


positioned then-candidate Donald Trump as “pro-military” 
or supportive of veterans and President Barack Obama, 
Vice-President Joe Biden, or then-candidate Hillary 
Clinton as opposed to veterans and the military served 
to build and reinforce a partisan divide. This divide was 
then further exploited by the fraudulent veteran pages to 
spread disinformation or fake news relating to other issues 
ranging from race-baiting to anti-Semitism to Antifa. These 
fraudulent pages also often distribute fake news stories, 
including stories which resuscitate authentic issues from 
prior years, but change the dates to make it falsely appear 
that a given candidate or political party is promoting 
policies that hurt veterans or soldiers. Disinformation and 
fake news are also used by spoofers to target the broader 
electorate beyond veterans in order to achieve similar 
partisan divisions. 


The use of disinformation for partisan purposes in a spoofing 
operation occurred during the 2017 Alabama Special 
Election for U.S. Senate between Republican candidate 
Roy Moore and Democratic candidate Doug Jones.*° 
In that race, a Facebook page named “Dry Alabama” 
became “the stealth creation of progressive Democrats 
who were out to defeat Mr. Moore.”*” The “Dry Alabama” 
page was created by a Democratic operative named Matt 
Osborne who intended to spread false information tying 
Mr. Moore to a movement for the prohibition of alcohol in 
Alabama. The plan was to associate Mr. Moore with the 
prohibition effort to hurt his chances of earning votes from 
moderate, business-oriented Republican voters. Mr. Moore 
was never an advocate of the prohibition movement, and 
Mr. Osborne admitted that he had fabricated the claim.*® 


There was also a second known spoofing operation in 
this Alabama Senate race, in which a series of fraudulent 
Twitter accounts purporting to be Russians were established 
to follow Mr. Moore’s tweets. This gave the impression that 
Mr. Moore was being supported by Russian operatives.*? 
This spoofing campaign was funded by Democratic 
billionaire Reid Hoffman, with the intention of tying Mr. 
Moore to Russian operatives to support a parallel effort 
in which the spoofers would pose online as conservative 
Alabamians advocating a write-in campaign in lieu of 
voting for Mr. Moore.°° The problem of spoofing is not 
limited to one side of the political aisle and its victims are 
the American people. If individuals or groups are able to 


44 JOHN D. GALLACHER ET AL., COMPUTATIONAL PROPAGANDA RESEARCH PROJECT, JUNK NEWS ON MILITARY AFFAIRS AND NATIONAL SECURITY: SOCIAL MEDIA DISINFORMATION CAMPAIGNS AGAINST US 


MILITARY PERSONNEL AND VETERANS (2017), http://comprop.oii.ox.ac.uk/research/working-papers/vetops/. 


45 LEO G. STEWART, AHMER ARIF & KATE STARBIRD, UNIVERSITY OF WASHINGTON, EXAMINING TROLLS AND POLARIZATION WITH A RETWEET NETWORK (2018), https://faculty.washington.edu/kstarbi/examining-trolls- 


polarization.pdf. 


6 Scott Shane & Alan Blinder, Democrats Faked Online Push to Outlaw Alcohol in Alabama Race, THE NEW YORK TIMES (Jan.7 2019), https://www.nytimes.com/2019/01 /O07/us/ politics /alabama-senate-facebook-roy-moore.html. 


47 ld. 
48 ld. 
49 Id. 


50 Scott Shane & Alan Blinder, Secret Experiment in Alabama Senate Race Imitated Russian Tactics, THE NEW YORK TIMES (Dec. 19, 2018), httos://www.nytimes.com/2018/12/19/us/alabama-senate-roy-jones-russia.html. 
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influence elections with false narratives, then faith in the 
electoral process is undermined.” 


While the net effect of such spoofing campaigns often 
has specific political objectives, the methods and content 
used to achieve the requisite divisions in society are often 
deployed through facially apolitical or neutral pages (e.g. 
the fake Vietnam Vets of America, Veterans Nation, We Are 
Veterans).°* On the other hand, there are also specifically- 
partisan pages, like Vets For Trump, that peddle similar 
content with the same underlying objective of sowing 
social divisions through illegitimate means.°* These overtly 
partisan pages or websites generally lack any official 
relationship with the candidate or party they ostensibly 
support, and often originate overseas. A foreign-based, 
partisan-identified page disseminating propaganda or 
divisive content would be the clearest example of the threat 
posed to American election integrity from foreign spoofers. 


A foreign-based, partisan-identified page 
disseminating propaganda or _ divisive 


content would be the clearest example of the 
threat posed to American election integrity 
from foreign spoofers. 





For example, in the spring of 2019, a legitimate American 
Facebook page called “Vets For Trump” was hijacked by 
Macedonian actors for several months.® The legitimate 
owners contracted with a Macedonian firm to manage 
and expand the page’s advertising revenues, and the 
Macedonian actors exploited their access to take over 
complete control of the page and lock out the American 
owners.°° During this period of exclusive Macedonian 
control, the spoofers used PayPal for fraudulent fundraising, 
but the PayPal account they used was tied to a known 
Macedonian spoofer and had no connections to legitimate, 
registered American fundraising entities.” Thus, unwitting 
donors who were lured into this site and who genuinely 
believed that they were making political contributions 
to support President Donald Trump through “Vets For 


51 — Election infrastructure targeted to “undermine confidence in election”. S. Rep. No. 116-XX, Volume 1 at 10 (2019). 
52 GOLDSMITH, VVA REPORT, at 58. 

53 Idvat7. 

54 Ie. 

55 Id. at 142. 





Trump” were actually funding this group of Macedonian 
spoofers.°® This marks one of the first known instances of 


foreign interference in American political activity ahead of 
the 2020 election.°’ 


The general analysis of foreign influence in the 2016 
election identified vulnerabilities and opportunities for 
leverage that have not yet been adequately addressed at a 
systemic level.°° The current approach of ad-hoc review and 
removal of violative content by the social media platforms 
themselves enables the perpetrators to continue operations 
by simply creating new accounts or switching platforms. 
The intelligence community’s assessment of the 2016 
election was that foreign actors, primarily Russia’s Internet 
Research Agency (IRA), were successful in conducting 
broad disinformation campaigns across multiple social 
media platforms that targeted specific rift lines in the 
American electorate.” The Senate Select Committee on 
Intelligence published a five-volume bipartisan report 
focused on Russia’s influence operations.®? The second 
volume focused on Russia’s use of social media platforms 
to influence the election, while the third volume focused 
on the short comings of the Obama Administration efforts 
to combat the ongoing attacks. The overarching theme of 
this third volume highlighted the lack of U.S. legislative or 
regulatory action to combat a known threat emanating 
from Russia and its intelligence services.* The Senate 
reports shed light on the broader issues presented in the 
Vietnam Veterans of America report of misinformation 
campaigns and predatory schemes on veterans. 


The current approach of ad-hoc review 
and removal of violative content by the 
social media platforms themselves enables 


the perpetrators to continue operations by 
simply creating new accounts or switching 
lol age qui te 


Russian state-backed GRU disinformation campaigns 
actually increased in the aftermath of the 2016 election, 
according to the Senate Intelligence Committee report.® 


56 Id. at 145; Craig Timberg, The Facebook Page ‘Vets for Trump’ Was Hijacked by a North Macedonian Businessman. It Took Months for the Owners to Get It Back., THE WASHINGTON POST (Sept. 17 2019), https://www. 
washingtonpost.com/technology/2019/09/ 17 /popular-facebook-page-vets-trump-seemed-be-place-former-military-months-macedonians-controlled-it/. 


57 GOLDSTEIN, VVA REPORT, at 149-155. 
58 Id. 
59 Id. 


60. Karoun Demirjian & Devlin Barrett, Obama Team's Response to Russian Election Interference Fell Short, Senate Report Says, THE WASHINGTON POST (Feb. 6, 2020), https://www.washingtonpost.com/national-security/obama- 
teams-response-to-russian-election-interference-fell-short-senate-report-says/2020/02/06/93c2tdac-48f2- 1] ea-9164-d3154ad8a5cd_story.html. 


61 HVAC Round Table Discussion with FBI on January 14, 2020. 
62. S. Rep. No. 116-XX, Volume 3 (2020). 
63 Id. 


64 Id.; see also Karoun Demirjian & Devlin Barrett, Obama Team's Response fo Russian Election Interference Fell Short, Senate Report Says, THE WASHINGTON POST (Feb. 6, 2020), https://www.washingtonpost.com/national-security/ 
obama-teams-response-to-russian-election-interference-fell-short-senate-report-says/2020/02/06/93c2fdac-48f2- 11 ea-9164-d3154ad8a5cd_story.html. 
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Foreign actors continue to pursue disruption of the American 
political process by spreading disinformation, divisive 
content, or propaganda, and it is not clear that social 
media platforms have sufficiently addressed this threat 
or prepared their users to protect themselves. Spoofing 
and disinformation have continued to be a present and 
growing threat over the past three years and are only likely 
to increase in an election year.°° 


The spoofing threat has evolved and expanded since 
2016, with a greater role now played by Instagram and 
YouTube in the dissemination of disinformation, memes, 
and political propaganda.” As younger users migrate 
away from Facebook, these and other emerging platforms 
are becoming more popular and influential with that 
demographic. The visual nature of the content on both 
Instagram and YouTube also supports the dissemination of 
memes and videos, which are very effective conduits for 
disinformation. For example, in the midst of the coronavirus 
pandemic, a YouTube video posted by a QAnon supporter 
combined numerous false and misleading claims to suggest 
that the pandemic was actually a political hoax.®* The video 
subsequently garnered millions of views across multiple 
other social media platforms.°? 


Researchers have also found that the YouTube 
recommendation algorithm steers viewers toward 
increasingly radical and extreme videos.” Foreign entities 
may be able to quietly disseminate disinformation by 
generating innocuous and popular content, and then 
relying on the algorithm to divert viewers or subscribers 
to other less innocuous content. For example, the third 
largest reach of any entertainment channels on YouTube 
in November 2019 (surpassed only by Disney and Warner 
Media) was held by TheSoul Publishing — a Cypriot entity 
run by Russian nationals, with YouTube and Google 
advertising revenues of tens of millions of dollars.” While 
the vast majority of YouTube content created and posted 
by TheSoul Publishing consists of short, non-political videos 
related to crafting, hobbies, and listicles, they also post some 
videos featuring political and historical disinformation with 


strong pro-Russian and anti-American perspectives.”” By 
accumulating a massive subscriber base for their various 
channels, TheSoul Publishing and similar entities are able 
to establish a built-in audience to which it can distribute its 
disinformation and political content.” TheSoul Publishing 
has also purchased Facebook advertisements on political 
issues targeting American voters, and used rubles to pay 
for the ad buys.” The cross-pollination of content across 
the various social media platforms further enables the 
rapid dispersal of specific messages, particularly memes 
and videos. 


Instagram, one of the leading repositories for memes and 
owned by Facebook, actually had substantially more user 
engagement with content posted by the Russian IRA than 
Facebook did in 2016, despite having a smaller overall 
user base.” A panel of experts from Columbia University 
and two research firms, New Knowledge and Canfield 
Research, prepared a report for the Senate Intelligence 
Committee in which they concluded that there were 187 
million user engagements with IRA material on Instagram— 
more than twice as many as on Facebook (77 million) 
or Twitter (73 million).”% It is possible that much of the 
disinformation campaigns will move to Instagram to take 
advantage of the younger audience.”” 


Instagram is poised to play a significant role in the 2020 
election and beyond due to the popularity of sharing 
visual content and engagement on social issues, especially 
among young Americans, the ease of sharing content on the 
platform, and the greater challenges in identifying corrupt 
activity on its feeds.”® Instagram is owned by Facebook, so 
it has been able to leverage the power of Facebook’s vast 
resources, including data and capital.”” Furthermore, due 
to Instagram’s picture based sharing format, it is rapidly 
becoming the platform of choice for those who wish to 
peddle misinformation and false news stories in an easily 
digestible and rapidly dispersed manner.®° Importantly, 
the spread of false information and proliferation of 
spoofed accounts is more complicated to detect because 
of Instagram’s visual medium as opposed to Facebook 


66 Suzanne Spaulding, Jason Gresh, Devi Nair & Alexandra Huber, Why the Kremlin Targets Veterans, CSIS (Nov. 8, 2019), httos://www.csis.org/analysis/why-kremlin-targets-veterans. 
67 PAUL M. BARRETT, NYU STERN CENTER FOR BUSINESS AND HUMAN RIGHTS, DISINFORMATION AND THE 2020 ELECTION: HOW THE SOCIAL MEDIA INDUSTRY SHOULD PREPARE (2019), https://issuu.com/ 


nyusterncenterforbusinessandhumanri/docs/nyu_election_2020_report?fr=sY2QzYzZIOM|MwMA. 


68 The Associated Press, Video Stitches False Claims Together to Paint COVID-19 as a Political Hoax, AP NEWS (July 9, 2020), https://apnews.com/ats:Content:9065413346. 


69 Id 


70 Karen Kornbluh, The Internet's Lost Promise: And How America Can Restore It, FOREIGN AFFAIRS (September/October 2018), https://www-foreignaftairs.com/articles/world/2018-08- 14 /internets-lost-promise. 
71 Lisa Kaplan, The Biggest Social Media Operation You've Never Heard of Is Run Out of Cyprus by Russians, LAWFARE, (Dec. 18, 2019), httpos://www.lawfareblog.com/biggest-social-media-operation-youve-never-heard-run-out-cyprus- 
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or Twitter, where text-based content is predominately 
shared.®| 


Text based posts can be analyzed by automated systems 
to detect origination and identify malign posts very 
efficiently by the platforms.** Memes spread on Instagram 
pose a different and specific danger because they require 
additional human review to make nuanced determinations 
as to whether they are being shared as parody, satire, 
and other forms of humor or if the meme is intentionally 
spreading misinformation and originated with a malicious 
actor, such as the Russian IRA.®° Facebook notes that its 
enforcement is based on behavioral patterns, so whether 
someone is sharing a meme or text, the deceptive patterns 
behind that behavior (such as fake accounts, coordinated 
infrastructure, etc.) will still be identifiable. However, 
disinformation can often be spread without inauthentic 
behavior, such as when an unsuspecting user views and 
spreads a meme believing it to be real or not knowing that it 
originated from a malicious actor. “Campaigns begin with 
posts in blogs or other news outlets with low standards. If 
all goes well, somebody notable will inadvertently spread 
the disinformation by tweet, which then leads to coverage 
in bigger and more reputable outlets. The problem is, taking 
the trouble to correct disinformation campaigns like these 
can unintentionally satisfy the goal of spreading the meme 
as far as possible—a process called amplification. Memes 
online make hoaxes and psychological operations easy 
to pull off on an international scale.”® In effect, efforts to 
correct disinformation or provide necessary factual context 
for misleading news may actually result in drawing greater 
attention and more views to the original disinformation. 


According to disinformation analysts, viral memes and 
videos are very popular among perpetrators due to their 
virtually untraceable origins, ease of construction, and 
rapid dissemination to a wide audience.* Another reason 
these types of memes spread so efficiently on Instagram is 
account administrators make their pages private which in 
turn requires users to subscribe in order to view the content 
— this tactic increases subscribers and results in more users 
seeing the pages’ posts on their feeds as opposed to 
someone sending it to them through private messaging.°° 


81 Id. 
82 HVAC Committee Hearing Transcript, at 49. 
83 HVAC Interview with Nathaniel Gleicher on Nov. 1, 2019. 





Facebook and Twitter have taken starkly divergent 
approaches to regulating certain political content on 
their respective platforms. While Twitter no longer allows 
any paid political advertising,®*” Facebook continues to 
allow paid advertising. Moreover, Facebook's policy 
is that speech and opinions from politicians (elected 
officials, candidates, or their campaigns) are not eligible 
to be fact-checked.®® Facebook has engaged independent 
third-party fact-checking partners to whom it delegates 
the verification responsibilities, including considerable 
discretion in selecting content to be reviewed.®’ Although 
Facebook claims that advertisements, including political 
advertisements, on the platform are “eligible” to be fact- 
checked by its third-party partners, the broad exclusions 
for political statements and opinions seem to effectively 
nullify the potential benefits of any such verification. 
Facebook notes that advertisements from Super PACs or 
other outside groups will still be subject to fact checking, 
and that if a politician shares another user’s post that has 
already been fact-checked, the politician’s post will show 
the same warning labels from fact-checkers.”° 


On its face, Facebook's policy would seem to create 
a ripe opportunity to post disinformation in the guise of 
advertisements containing “political opinion,” and creates 
a loophole to avoid fact checking or verification. When 
any such advertising campaign is specifically oriented 
towards veterans or veterans’ issues, an imminent risk 
arises of directly channeling disinformation to veterans and 
VSOs. Moreover, neither policy addresses the distribution 
of propaganda, political disinformation, or doctored 
media for political purposes when such distribution occurs 
outside of the context of official paid political advertising. 
Facebook does label content from state-controlled media 
entities to enable users to identify news articles posted 
by these official channels.”' Ahead of the 2020 election, 
Facebook is blocking ads from state-controlled media 
outlets targeted to people in the US.” 


The Facebook political advertising loophole has already 
been exploited to distribute some controversial content. 
For example, an advertisement by the Trump campaign 
alleging that Vice President Biden withheld $1 billion in 
U.S. foreign aid to Ukraine to pressure the country into 


84 Joan Donovan, How Memes Got Weaponized: A Short History, MIT TECHNOLOGY REVIEW (Oct. 24, 2019), https://www.technologyreview.com/2019/10/24/ 132228 /political-war-memes-disinformation/. 
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87 Twitter, Political Content Policy, https: //business.twitter.com/en/help /ads-policies/ads-content-policies/political-content.html. 

88 Facebook, Fact-Checking Program Policies, https://www.facebook.com/business/help/315 131736305613 2id=673052479947730; see also Mike Isaac and Cecilia Kang, Facebook Says It Won't Back Down From Allowing Lies in 
Political Ads, THE NEW YORK TIMES Vianuary 2020), https://www.nytimes.com/2020/01 /09/technology/tacebook-political-ads-lies.html. 
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removing a prosecutor investigating a firm affiliated with 
Biden’s son was posted and allowed on Facebook, but other 
outlets rejected or removed the ad for unsubstantiated or 
misleading claims.”? Facebook specifically cited its policy 
on politicians and campaigns in its response to the Biden 
campaign, rejecting the request for removal.” Twitter 
also allowed this ad, although it came before its ban on 
paid political advertising.”> Factcheck.org, one of the 
leading nonprofit arbiters of truth and deception in politics, 
determined that the ad was misleading.”° More recently, 
the Trump campaign has itself asked Facebook to remove 
a video from Vice President Biden’s account that contains 
quotations from an Atlantic article which purport to show 
President Trump repeatedly disparaging veterans and the 
military.” The Trump campaign notes that President Trump 
denies all of the quotations attributed to him, and therefore 
the video should be considered false and misleading.” 
However, several news organizations have independently 
verified parts of the disputed allegations and maintain the 
accuracy of the claims.”? 


Commercial Fraud and Scams 


VETERANS THEMSELVES CAN ALSO BE DIRECT 
VICTIMS OF SPOOFINGIN CASES OF COMMERCIAL 
fraud. Imposters use fake social media accounts, often 
posing as a VSO or other veteran interest group, to 
defraud the victim by selling fake merchandise, obtaining 
financial data, or even illegal fundraising.'°° A 2017 report 
prepared by the American Association of Retired Persons 
(AARP), found that “more than twice as many veterans 
as nonveterans lost money to scam artists during the past 
five years. Some of the scams were aimed specifically at 
programs and charities geared to veterans.” '°! 


Commercial fraud aimed at veterans plays on many of 
the same, emotionally-triggering themes as used in the 
political propaganda campaigns, but instead of pursuing 
endorsement and distribution of specific content, these 
scams involve financial transactions. At one end of the 
scale, the scam is a simple one-time fraudulent purchase 
(for example, unsanctioned memorabilia, or fake/ knock- 





off merchandise). The more sophisticated and devious 
plots aim to extract larger sums of money over longer time 
periods, or in the extreme example, even obtain the victim’s 
actual financial information. 


An important subset of the online fraud perpetrated against 
or through veterans is the category of romance scams, in 
which scammers pose as veterans seeking a relationship and 
send requests to victims for money based on fabrications. 
Spoofers appropriate real veterans’ images and stories, 
including veteran families’ grief and hardships — in order 
to scam individuals who are sympathetic and supportive 
of veterans. The overall volume of online fraud claims runs 
into the billions of dollars and is increasing.'” 


A 2017 report prepared by the American 
Association of Retired Persons (AARP), 
found that ‘more than twice as many 


veterans as nonveterans lost money to scam 

artists during the past five years. Some of the 

scams were aimed specifically at programs 
and charities geared to veterans.’ 


In instances of financial fraud or romance scams, criminals 
are exploiting the general sense of trust that the American 
people have in those who serve in uniform. People lower 
their guard when interacting with someone who is serving 
the country, and that includes when interacting online. 
There is a large organized crime ring based in Nigeria that 
recognizes this and has built an industry around stealing 
veterans’ identities for use in financial scams. These men in 
Nigeria proudly call themselves “ Yahoo Boys,” a nickname 
that came about in the 1990's based on email scams from 
supposed “Nigerian Princes” who offered huge deposits in 
exchange for private banking information.'™ 


Online criminals often steal veterans’ deployment photos 
and use them to create online social media profiles. They 
then use those imposter profiles to enter online groups 
which are made for grieving Gold Star families. These 
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predators know that with a military death comes a large life 
insurance payout, so they use stolen identities to comfort 
widows and widowers, offering love and attention. After 
weeks or months of grooming a victim, forming what the 
victim believes to be a romantic relationship, the scammers 
will make up stories about being in desperate financial 
situations. Victims will often send large sums of money 
believing that they are helping a service member in need, 
or to pay for an airline ticket for facilitating a romantic 
meeting. Then the scammers doctor photos of plane tickets 
and send them fo victims. Victims often end up waiting at an 
airport for hours before they come to realize the scam." 


News reports have documented several cases where victims 
of these scams die by suicide after realizing that they were 
tricked into giving away their life savings.’ The subject 
of a New York Times article on veteran-based romance 
scams, one individual lost between $26,000 and $30,000 
in just two years to an imposter posing as a veteran.'° 
After sending the imposter $5,000 for what was supposed 
to be plane tickets to visit, the victim attempted suicide.'” 
During the investigation for the New York Times article, this 
spoofing victim was killed by her husband, who also killed 
himself and the victim’s father.'©° 


What Spoofing Looks Like 


THE EFFECTIVENESS OF SPOOFING CAMPAIGNS 
LIES IN THE ABILITY OF THE SPOOFER TO PRESENT 
content online in a manner that appears ordinary and 
credible, while actually advancing a malicious intent. The 
examples below document how spoofing manifests in both 
the spreading of political propaganda and the perpetration 
of commercial fraud. 


Political Propaganda & Socially Divisive Content 


THE IMAGE BELOW WAS POSTED BY THE 
FACEBOOK GROUP “VIETNAM VETERANS” IN 
January 2020.'" “Vietnam Veterans” has stolen content 
from a nationally chartered VSO and has ties to pages 
known to be operated from outside the U.S."° The image 
depicts former professional football player Pat Tillman, 
who quit the National Football League and enlisted as 
an Army Ranger in response to the terrorist attacks of 
September 11, 2001. Tillman was subsequently killed in 
action. The image of Tillman is juxtaposed with a caption 


104 ld. 
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disparaging Colin Kaepernick, another former National 
Football League (NFL) player who gained notoriety for his 
pre-game protests in which he knelt during the National 
Anthem to draw attention to the issues of police brutality 
and racial disparities in police shootings. The image on the 
bottom features Kaepernick again, this time contrasting him 
with Glen Coffee, another former NFL player who enlisted 
in the Army." 


Vietnam Veterans 
e 
New vietnam veteran memonal kn 


With all this drama about some sissy QB 
named Colin I decided i would post a 
pic of a real NFL player who left the 
NFL to serve his country and made the 
ultimate sacrifice. Forget sissy's like 
Kaepernick and remember real heroes 
like Pat Tillman. 


MU THI dd tae 


Peta 2 a 


PLAYED FOR THE PLAYED FOR THE 
SAN FRANCISCO 49ERS SAM FRANCISCO 49ERS 

DRAFTED IN THE THIRD DRAFTED IN THE THIRD 
ROUND OF THE NFL DRAFT ROUND OF THE NFL DRAFT 
REFUSED TO STAND FOR THE GAVE UP A LAVISH 

NFL CAREER TO SERVE HIS 
COUNTRY AS AN ARMY RANGER 





In both instances, Kaepernick is being contrasted with 
other former NFL players who left professional football to 
join the military, ostensibly to differentiate the privileged 
athlete from those who sacrificed the same privilege in 
order to serve the country. These are examples of socially 
divisive images being used to place veterans and “heroes” 
on one side and those protesting police brutality, or 
supporting Black Lives Matter, on the other. The first image 
is attempting to position veterans against Kaepernick’s 


109 Vietnam Veterans Facebook Page - a page purportedly for and run by veterans, is a spoofing page that drives people to merchandise sites and is run by zero individuals in the United States (an indicator of a spoofed page). Link 
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protest movement, which is closely associated with 
liberal sentiments and especially with racial minorities. 
By delineating the groups this way, this image also aligns 
veterans with law enforcement, further emphasizing that 
one side represents heroes, while the other side represents 
liberals, “sissy’s” [SIC], and perhaps minorities. The second 
image comes from a page called “Vets For Trump” that 
makes the same distinction, but with a more overt partisan 
affiliation. 


O all the overpaid kneelers in the NFL: 
Put on this uniform, then you might 
understand why we stand. 





Images that focus on divisive issues that fall on political 
fault lines are used to drive interactions for many purposes 
— commercial fraud, misinformation, and romance scams 
among many others. The following images highlight some 
of the political pressure points that spoofers use to increase 
the number of users exposed to their schemes. The image 
below, also posted by “Vietnam Veterans,” references the 
same Kaepernick protest with the text above the picture 
calling out “overpaid kneelers” and is meant to leverage the 
pain and loss felt by military families. Further, by conflating 
the issues and sacrifices of military members and veterans 
with issues of race and police enforcement, bad actors are 
able to sow anger and division. By artificially positioning 
these groups of “heroes” as opposed to everyone else, 
spoofers manipulate an emotional response and then call 
for “sharing” the post, leading to significantly increased 


exposure.'” 


The next image was posted by “Vets for Trump” and 
attempts to create the illusion that President Obama did 
not care about the military, while representing President 
Trump as someone who will take care of the troops. This 
type of imagery is misleading and pits two segments 


W2 ~~ Id. 
113 S. Rep. No. 116-XX, Volume 2 at 8 (2019). 
14 GOLDSMITH, VVA REPORT, at 145 


of the population against one another, Democrats and 
Republicans, and paints one party as respecting the 
military and the other as disrespecting it. The group “ Vets 
for Trump” was run by individuals outside the United States 
at one point, and fit the profile of activity outlined in the 
Senate Select Committee on Intelligence report on foreign 
interference.’ Facebook restored the Vets for Trump Page 
to its original owners in August 2019." 


ISN'T IT NICE TO HAVE A PRESIDENT 
OTS a ee 





This image below creates a false choice between veterans’ 
issues and immigration issues. By conflating the two issues, 
foreign actors are able take a point of agreement - veterans’ 
issues - and turn it into a pressure point of partisan fighting. 
Pushing this type of content drives page engagements and 
establishes a user base on whom spoofers can later run 
commercial or romance schemes, in addition to creating 
political interference. The image was posted by “Veterans 
Nation” which is run by a collection of administrators 
from Vietnam, Brazil, and Ukraine — notably none of the 
administrators are based in the United States. Furthermore, 
the “Veterans Nation” group shares the same content 
created by the “Vets for Trump” page." 


ah 
UU ELS) 


@Respecting yi eloy past and present 


rea a Sa 
| 
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Divisive issue pushing is not unique to any one political 
group or viewpoint. Below is a screen grab from “ Vietnam 
Veterans Advocacy Group,” which shared only pro- 
Obama and anti-Trump articles from unreliable and 
questionable websites. The article attempts to smear 
President Trump using rumors and tabloid-style headlines. 
By driving views from both sides of the political divide, 
foreign influence operations can effectuate the sowing of 
discord and distrust in American institutions highlighted in 
the Senate Select Committee on Intelligence Report."° The 
capitalization on political animosity is a driving force for 
misinformation, as well as the other fraudulent schemes 
spoofers attempt to execute. 


Vietnam Veterans 
Advocacy Group 


Trump just admitted he paid off Stormy Daniels. Michael 
Avenatti’s response is perfect - JustTheTruth 











Commercial Fraud 


AFTER DRIVING USER INTERACTIONS WITH 
SPOOFED PAGES, THE SCHEMES OFTEN TURN 
their efforts towards gaining profit through the sale of 
counterfeit products. The counterfeit products range from 
coins to flags and often use stolen intellectual property or 
copyright insignia. The images below show examples of 
commercial fraud, including the sale of products such as 
counterfeit commemorative coins, knives, and flags, often 
using stolen intellectual property. The first image shows the 
spoofed site “ Vietnam Vets Unite” Facebook page linking 
to an Amazon store. Once a user selects the link, the user 
is redirected to an Amazon store offering counterfeit VVA- 
branded merchandise from the seller Coins and Coins. 
The second image shows the Amazon storefront, with 
the counterfeit VVA-branded coin images. This scheme 
is repeated across different Facebook groups and with a 
multitude of counterfeit items.'” 


6 S. Rep. No. 116-XX, Volume 2 at 8 (2019). 
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Vietnam Vets Unite 
Like This Page 4 201 i) 


Vietnam Veterans Challenge Collectible Coin Logo 
Metal Lucky Poker Chips & Gift 
http://order.sale/DHYg (via Amazon) 





08 Vietnam Veterans Challenge Collectible Coin Logo Metal 
es Lucky Poker Chips & Gift 
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Available from these sellers. 
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A Spoofing Case Study - Vietnam 


Veterans of America 


THE COMMITTEE REVIEWED AN_ IN-DEPTH 
INVESTIGATIVE REPORT ON INTERNET SPOOFING 
specifically targeting veterans that was researched and 
prepared by Kristofer Goldsmith of VVA."° Mr. Goldsmith 
also appeared before the Committee to offer testimony 
about his research." 


In August of 2017, VVA discovered an imposter Facebook 
page that misappropriated VVA’s trademarked name 
and logo and was linked to a suspicious European-based 
website. The spoofed page was spreading falsified news 
stories on issues specifically associated with veterans. The 
discovery of the fake page led VVA to begin an investigation 
into online spoofing, which ultimately revealed a history of 
“persistent and pervasive foreign-born online campaigns” 
that had targeted the group and its members since at least 
2014.'2° After a few months of investigation, VVA shared its 
findings with law enforcement agencies and congressional 
committees, including this Committee. The initial findings 
identified an entity in Plovdiv, Bulgaria, as creator and 
manager of the spoofed page." 
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VVA eventually recognized that this instance of spoofing 
actually represented a more pervasive problem, stating: 


American veterans and the social-media followers of several 
congressionally chartered veterans service organizations 
were specifically targeted by the Russian Internet Research 
Agency with at least 113 ads during and after the 2016 
election. However, this represents but a tiny fraction of the 
Russian activity that targeted this community with divisive 
propaganda: The organic politically divisive content (organic 
meaning not having to do with ads, rather unpaid posts and 
comments) created by Russians have a far greater reach than 
the known paid ads; for even though many of the original 
sources have been removed from social-media_ platforms, 
their posts and comments continue to be propagated and 
disseminated by foreign administrators (aka admins, who 


maintain and manage online sites) to spread hateful and 


politically divisive messages. '*7 


VVA Encounters Challenges to Take Down 
Spoofed Site 


AFTER THE DISCOVERY OF THE SPOOFED PAGE ON 
AUGUST 21, 2017, VVA CONTACTED A MEMBER OF 
the Facebook security team on August 23, 2017, to notify 
them of the unauthorized and misappropriated use of VVA's 
name and logo, and to request that the fraudulent page be 
taken down. Following this initial notification, the spoofed 
page remained active and on September 26, 2017, the site 
shared a manipulated video that resulted in over 37,000 
views by October 3, 2017. VVA again reported the page to 
Facebook. A week later, on October 9, 2017, with Facebook 
offering no solution, VWVA went public with appeals to 
the Department of Defense (DoD) and the Department 
of Veterans Affairs (VA), requesting measures to protect 
service members and veterans from online foreign political 
influence.'2 By mid-October of 2017, Facebook stated 
that the spoofed page had not violated terms of service 
and placed the burden of clarification back on VVA.'% On 
October 24, 2017, Facebook finally removed the spoofed 
page, but only due to a finding that the page had violated 
VVA's copyright.’ To date, neither DoD nor VA have 
responded to VVA’s request for measures to protect service 
members and veterans. 
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Growth of Spoofed Site 


VVA FOUND IT VERY CHALLENGING TO 
CONVINCE FACEBOOK TO TAKE DOWN A SPOOF 
of its legitimate Facebook page, but the spoofed page 
was eventually taken down by Facebook. Facebook cited 
the copyright issues posed by the spoofed page as the 
reason for the page being removed and not spoofing.'”° 
However, in the interim, the incredibly rapid growth of the 
spoofed page made it difficult for users to recognize the 
spoofed VVA Facebook page as a spoof. The time from first 
notification to Facebook to the removal of the page was 
approximately two months. During that time the spoofed 
page gained nearly 200,000 followers and significantly 


more impressions. '~” 


As the VVA report explains, a large number of followers 
provides credibility for a spoofed page. Spoofers can 
increase the number of followers exponentially by 
distributing posts that are a mix of politically divisive (such 
as memes of politicians and policy agendas) and generally 
soothing posts (such as crafting or animal videos). This 
mixture of content drives the number of likes, shares, 
comments, and interactions which in turn escalate the 
influence of these malign actors. 


Spoofed accounts or pages frequently feature a pattern of 
rapid growth of the subscriber base, which often massively 
surpasses the subscriber base of legitimate veterans’ 
and VSO pages. Very rapid growth for a new site, and 
particularly for sites whose posting patterns are irregular, 
voluminous, or repetitive, may indicate spoofing activity. 
VVA noted, “The rate at which the [fake] ‘Vietnam Vets of 
America’ page grew in followers is staggering. According 
to their ‘About’ tab, they went from 30,000 followers 
on November 1, 2016, to 196,567 as of October 2017. 
For comparison, the real VVA page has only garnered 
approximately 137,000 likes since it was created in June 


2010," 
Conclusion of VVA Investigation 


AFTER DISCOVERING THE SPOOFED SITE, 
CONDUCTING AN INITIAL INVESTIGATION, AND 
notifying Facebook, Congress, and VA, VVA then took 
the initiative to conduct a full, two-year investigation on 
spoofing and the veterans community. The investigation 
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resulted in the documentation of “persistent, pervasive, and 
coordinated online targeting of American servicemembers, 
veterans, and their families by foreign entities who seek to 
disrupt American democracy.”'”? During the Committee 
hearing, Rep. Michael Bost (R-IL) queried Mr. Goldsmith 
about what VVA was doing to inform and assist veterans 
with the problems caused by spoofing.’°° Mr. Goldsmith 
noted that VVA primarily uses Facebook and Twitter to 
educate and communicate with veterans. So, when spoofers 
use Facebook and Twitter to spread disinformation it 
becomes very difficult for veterans to distinguish legitimate 
content from illegitimate content.’*' Mr. Goldsmith went on 
to say that this problem illustrates the urgent need for the 
social media platforms and the VSOs to develop strategies 
to help veterans identify potential disinformation online.’ 


Based on its own experience of being spoofed, and 
considering the lessons gleaned from its extensive 
investigation, VVA recommended that the social media 
platforms draw upon the resources within the veterans’ 
community by partnering with the VSOs in order to help 
raise awareness of the problems and permutations of 
spoofing. Additionally, such partnerships would also 
provide the social media platforms with access to military 
and veteran expertise that could help refine the platforms’ 
ability to detect and discern misrepresentation or fraud 
targeted at veterans. Finally, VVA also urged all parties to 
collaborate in facilitating assistance to victims of spoofing 
by streamlining and expediting the process of reporting 
and removing spoofing activity on the platforms. 


Scope of the Spoofing Problem 


IN TRYING TO DETERMINE THE SCOPE OF THE 
PROBLEM POSED BY INTERNET SPOOFING, 
the Committee requested an analysis by Graphika, a 
firm specializing in the study of social networks, data 
manipulation, and how messaging on these networks 
evolves and spreads.’*? Dr. Vlad Barash of Graphika 
performed a study of disinformation campaigns targeting 
American veterans and military service members to 
understand the volume and timeframe of these messaging 
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campaigns, as well as specific details of the targeted 
communities and the substantive message contents. 


Graphika identified a troubling trend in its 
analysis of disinformation operations. The 


rate of activity targeting American veterans 
and military service members has increased, 
not decreased, since the 2016 U.S. election. 





Graphika based its analysis on one dataset collected 
for a previous study, several datasets that were publicly 
released by Twitter following discovery and verification 
of state-backed foreign ownership, and one Facebook 
dataset that was developed and collected by VVA.'* 
Graphika determined that just 2,106 Twitter accounts 
associated with veterans and/or military personnel were 
able to ultimately reach over 5,000,000 Twitter accounts. 
Similarly, on Facebook, Graphika found that a mere 41 
pages oriented at veterans or service members reached 
a total of 18,298,968 followers. Both results revealed a 
“powerful multiplier effect” that extended the reach and 
potential audience achievable through the manipulation 
of a relatively small number of social media pages or 
accounts.’*° Moreover, Graphika identified a troubling 
trend in its analysis of disinformation operations. The rate 
of activity targeting American veterans and military service 
members has increased, not decreased, since the 2016 
U.S. election.*° 


Graphika continues to uncover and expose ongoing 
information operations that target the 2020 Presidential 
election, making these types of campaigns a persistent 
threat for our democracy. Graphika anticipates that these 
campaigns will continue to target influential American 
communities, including veterans and the military.'*” Previous 
research has found that “U.S. veterans and members of 
our military are highly respected members of society who 
“vositively influence their country and their community.” °° 
Graphika’s analysis of the 2,106 veteran-associated 
Twitter accounts mentioned above identified some of 


32 Hijacking Our Heroes: Exploiting Veterans through Disinformation on Social Media Before the H. Comm. On Veterans’ Affairs, 116th Cong. (2019) (written testimony of Mr. Kristofer Goldsmith, Chief Investigator & Associate Dir. Of Policy 
& Gov. Affairs, Vietnam Veterans of America, at 11-12) (access Mr. Goldsmith's written testimony here, https: //docs.house.gov/meetings/VR/VROO/20191113/ 110183 /HHRG- 116-VROO-Wstate-GoldsmithK-20191113.pdf). 
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AFFAIRS AND NATIONAL SECURITY: SOCIAL MEDIA DISINFORMATION CAMPAIGNS AGAINST US MILITARY PERSONNEL AND VETERANS (2017), http://comprop.oii.ox.ac.uk/research/working-papers/vetops/); datasets of 
foreign information operations on Twitter, curated and publicly released by the company (Vijaya Gadde, & Yoel Roth, Enabling further research of information operations on Twitter, TWITTER: COMPANY BLOG (Oct. 17 2018), https://blog. 
twitter.com/en_us/topics/company/2018 /enabling-further-research-of-information-operations-on-twitter.html}; and a dataset collected by Kristofer Goldsmith of VVA of activity around Facebook public pages on veteran and military- 
related topics with foreign administrator accounts (KRISTOFER GOLDSMITH, VIETNAM VETERANS OF AMERICA, AN INVESTIGATION INTO FOREIGN ENTITIES WHO ARE TARGETING SERVICEMEMBERS AND VETERANS ONLINE 
(2019), https://wa.org/wp-content/uploads/2019/09/VVA-Investigation.pdf). See Hijacking Our Heroes: Exploiting Veterans through Disinformation on Social Media Before the H. Comm. On Veterans’ Affairs, 116th Cong. (2019) (written 
testimony of Dr. Vlad Barash, Science Dir., Graphika) (access Dr. Barash’s written testimony here, https://docs.house.gov/meetings/VR/VROO/20191113/ 110183 /HHRG- 116-VROO-Wstate-BarashV-20191113. pdf). 
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“influencers” in this discussion.'’*’ “Influencers” 
are individual accounts that have a disproportionate 
impact in trend setting and distribution of content, and 
are exceptionally valuable for marketers, entertainers, 
fashion/ consumer goods labels and in the case of those 
seeking to spread disinformation or political propaganda, 
have the ability to reach a broad audience very quickly and 
efficiently.“° The specific targeting of influencers to quickly 
and broadly disseminate messages is a very effective and 
dangerous tactic. A key influencer retweeting or posting 
about a single piece of disinformation can significantly 
amplify the impact and reach of that disinformation, 
especially as compared to a non-influencer. 
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Graphika also noted that the Twitter posts examined in its 
study generally referenced key topics of particular interest 
to U.S. service members or veterans. This included messages 
that were positive, such as supporting troops, or negative, 
such as discussing the challenges of post-traumatic stress 
disorder or homelessness among the veteran community." 
As discussed above, the use of carefully selected topics to 
trigger an emotional response along with an endorsing 
action (liking, sharing, or retweeting) is a common 
technique used by spoofers to quickly disseminate their 
content with the imprimatur of an authoritative voice.*” 
Foreign based spoofers are then able to inject their own 
agenda and propaganda into the discussion around these 
important subjects, without the knowledge of the readers 
and viewers who receive the content from an ostensibly 
authentic and authoritative source.'’*° 





Graphika has observed the effectiveness of Russian and 
lranian operations in targeting American audiences with 
disinformation in order to sow public discord.’* Foreign 
information operations targeting U.S. veterans and 
military members are found across social media platforms, 
have been ongoing since at least 2011 and are steadily 
growing, according to Graphika’s analysis.'*° Although 
when taken in the context of the overall scale of all social 
media content, these operations only account for a very 
small number of messages or pages, the volume of the 
raw data belies its impact. Additionally, the content of the 
messages demonstrates that they were carefully crafted to 
hijack key topics of discussion among U.S. veterans and 
military service members, for example by inserting calls to 
violence into positive messages around troop support.” '4° 


Ranking Member Dr. Roe asked Dr. Barash, “First, are 
veterans targeted for scams at a higher rate than non- 
and “. . . secondly, are veterans targeted for 
propaganda ata higher rate than non-veterans” (emphasis 
added).’” Dr. Barash responded, “Yes and yes. Veterans 
are an influential community in our social fabric online and 
offline. And as a result, it is much more effective to target 
them with all kinds of operations including propaganda.” “® 


veterans” 


Veterans are an influential community in 
our social fabric online and offline. And as 
a result, it is much more effective to target 


them with all kinds of operations including 
propaganda. 
— Dr Vlad Barash 


Graphika’s ultimate conclusions about Twitter both support 
and complement VVA’s findings regarding Facebook. 
Graphika’s analysis demonstrates that the contents of 
the data sets indicated a precisely targeted campaign 
to exploit an influential American community in order to 
spread disinformation as broadly and as persuasively 
as possible and not randomly generated Tweets.” This 
result mirrors the Facebook example documented by VVA, 
where just a few foreign-run pages oriented at veterans 
successfully reached an audience of millions.'°° 
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140 Ismael El Qudsi, What To Expect For Influencer Marketing in 2020, FORBES (Feb. 6, 2020), https: //www.forbes.com/sites/forbesagencycouncil/2020/02/06/what-to-expect-for-influencer-marketing-in-2020/#49] d71965c09. 
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Dr. Barash also informed the Committee that there were 
significant constraints imposed upon his analysis by the 
limitations on the data sets made available by the social 
media platforms. Consequently, there are still considerable 
barriers to fully documenting the nature and scale of the 
problem. He noted that, “The data available so far allow 
for a piecemeal analysis approach to a multi-faceted 
operation.” *' Twitter separately confirmed tothe Committee 
that its internal analysis supports a finding of additional 
social media activity on other platforms involving the same 
foreign-based accounts in these datasets, but metrics on 
volume, timeframe, or content were not available.'*? Dr. 
Barash strongly stressed the need for comprehensive data 
collection by the social media platforms, and collaborative 
analysis based on shared access to the data in order to 
make final determinations about the scope, impact, and 
likely developments in information operations against 
American veterans and servicemembers.’ 

Dr. Barash concluded that based on what he knows to 
date, his analysis clearly demonstrates the need for a 
broad-based approach to protecting and supporting the 
veteran and military communities from foreign entities 
targeting them on social media. Specifically, he suggested 
that the press and educational institutions should provide 
resources and fact-checking efforts specifically geared 
towards American veterans in order to help promote 
awareness around these types of foreign campaigns and 
the use of divisive content to drive the growth behind 
fraudulent accounts. Furthermore, he testified, research 
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152. HVAC Majority Staff Interview with Kevin Kane on October 17 2019. 
be Id, 

154 Id. 





institutions can fund, and researchers can develop, next- 
generation disinformation detection mechanisms which are 
community-focused and tailored to help flag suspicious 
social media content, as well as other new deterrence 
approaches. Dr. Barash recommended that the major 
social media platforms should work with Congress and 
the law enforcement agencies to take coordinated actions 
to protect our veterans by bringing greater transparency, 
easier access to data, and stronger detection tools to the 
social media experience.'** Such coordination and sharing 
of data would provide analysts such as Graphika with 
broader, more accurate information with which to properly 
understand the operations, scope, and activity patterns 
of the networks used by spoofers from around the world. 
Cooperation among the platforms in sharing data related 
to spoofing, fraud, or criminal activity, would permit 
analysts to perceive patterns, rather than solely examining 
discrete incidents and then trying to extrapolate patterns. 


Dr. Barash concluded that based on what 
he knows to date, his analysis clearly 
demonstrates the need for a broad-based 


approach to protecting and supporting the 
veteran and military communities from 
foreign entities targeting them on social 

media. 
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The SOCIAL MEDIA PLATFORMS 





THE COMMITTEE SOLICITED TESTIMONY FROM 
TWO OF THE MOST SIGNIFICANT SOCIAL MEDIA 
PLATFORMS: FACEBOOK AND TWITTER. 


Facebook 


FACEBOOK IS THE LARGEST SOCIAL MEDIA 
PLATFORM, WITH 1.79 BILLION DAILY ACTIVE 
users as of June 30, 2020.'°° Additionally, itowns Instagram 
which has over 1 billion monthly users, and messaging app 
WhatsApp, which has over 1.5 billion monthly users. Over 
2 billion people use Facebook, Instagram, WhatsApp, or 
Messenger every day on average.’° With this massive 
reach across multiple popular applications, Facebook 
has unparalleled influence in the realm of social media, 
which makes it particularly valuable for foreign spoofers 
attempting to interject external agendas into American 
political debates. Facebook was a significant vehicle of 
Russian interference in the 2016 election, as discussed in 
the Senate Intelligence Committee Report.” As both Mr. 
Goldsmith and Dr. Barash testified, there is a very real 
prospect that this type of foreign threat will again be a 
factor in the 2020 election. Further compounding the 
risk, Facebook Chief Executive Officer Mark Zuckerberg 
announced in late 2019 that Facebook will not be fact- 
checking any advertisements bought by politicians, 
candidates, or political campaigns, on the platform, 
arguing that private companies should not be censoring 
politicians.'°® 


How Facebook is Combatting Spoofing 


FACEBOOK’S DIRECTOR OF SECURITY POLICY, 
MR. NATHANIEL GLEICHER, TESTIFIED BEFORE 
the Committee that the platform’s commitment to honest 
interactions for its users starts with a set of basic policies to 
protect against what Facebook deems inauthentic behavior 
- including misrepresentation, fraud, deception, and spam. 
He stated that these policies are intended to create a space 
where platform users can trust the people and communities 
with which they are interacting. First, people are required 





to connect on Facebook using real names. Second, 
people are broadly prohibited from misrepresentation on 
Facebook, including the use of fake/fraudulent accounts, 
artificially boosting the apparent popularity of content (e.g. 
using bots or machines to automatically generate positive 
feedback for a given post), or to otherwise violate the 
published Community Standards of Facebook. Users are 
specifically prohibited from impersonating other persons, 
which is the fundamental aspect of spoofing.” Facebook 
policies also prohibit users from maintaining multiple 
Facebook profiles.'°° 


With this massive reach across multiple 
popular applications, Facebook has 
Wy Loteoli(-Ve-Xo MU -art-M mil Mato memeteLale] 


media, which makes it particularly valuable 

for foreign spoofers attempting to interject 

external agendas into American political 
debates. 


Notwithstanding these stated policies and the testimony 
of Mr. Gleicher, there are significant and material 
deficiencies in the implementation of these policies. 
Facebook frequently gets media attention for its removals 
of fake accounts, sometimes involving foreign actors or 
state entities.'°' However, the very existence of these 
fake accounts in the first place illustrates that Facebook’s 
policies against creating inauthentic accounts can be 
circumvented. Although Facebook requires real identities 
to be used to create accounts, in fact it is feasible for those 
real identities to be used to create accounts under different 
and fraudulent names, as happened in the example of 
VVA. In other words, while it is true that every account must 
be rooted in a real identity, that identity may not match 
the one being presented on Facebook. While the Facebook 
policy requires that such accounts be removed and shut 
down upon discovery, there are opportunities for spoofers 
to do significant harm before they are discovered and 
ousted. Additionally, Facebook also allows multiple pages 
to be connected to an individual account. These multiple 
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pages can be misleading to the unsuspecting user who 
simply engages with a page based on the name, picture, 
or logo, without assessing whether the underlying account 
is actually the one it purports to be, as again illustrated by 
the VVA example. Despite Facebook’s policies and efforts 
to verify the identities tied to accounts, there continue to 
be opportunities for spoofers to infiltrate the platform, at 
least until they are discovered. That said, it is also clear that 
Facebook has invested significantly to try to ameliorate 
this problem, and that these investments have undoubtedly 
contributed to blocking many such attempts to create 
fraudulent accounts, often automatically by technology 
that Facebook has installed.'” 


Additionally, Facebook also implements higher standards 
of verification, visibility, and transparency for pages that 
exceed a threshold for large numbers of followers, political 
'©3 Private 
Groups on Facebook, however, have emerged as a way that 
inauthentic accounts attempt to work around the verification 
and transparency requirements for large pages, and are 
therefore increasingly becoming the distribution network 
of choice for many spoofers disseminating propaganda.” 
Although Facebook maintains that it uses tools to detect 
and remove violating content within private groups, these 
groups can still contain vast networks of disinformation.’ 


advertisers, and certain commercial pages. 


Under its current spoofing enforcement structure, Facebook 
features four layered lines of review. The process is first built 
on automated computer detection of signals data about 
account creation and usage, such as the use of suspicious 
email addresses, suspicious activity patterns, or common 
signals previously associated with other fake accounts that 
have been removed (e.g., shared IP addresses). Facebook 
relies upon technology and machine-learning review 
to automatically detect and eliminate the most common 
threats. This reduces the noise in the search environment for 
the human reviewers by removing the most basic, crude, 
or unsophisticated threats, thereby making it easier for 
the investigators to isolate more sophisticated bad actors. 
Automated detection allows for the rapid analysis of very 
large quantities of data, which enables the detection of 
anomalies, discrepancies, patterns or trends that may be 
indiscernible to human reviewers. As previously noted, 
patterns of suspicious activity can be a more reliable 
indicator of fraudulent or spoofed accounts than the more 
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granular review applied by human reviewers.'®° 


The second layer is human review of actual pages, 
posts, and activity. Human investigators employed by 
Facebook and with experience in cybersecurity research, 
law enforcement, and investigative reporting, search 
for and remove the most sophisticated threats. To do so, 
they collaborate closely with Facebook's data science 
team, which uses machine learning and other advanced 
technologies to identify patterns of malicious behavior. 
Human review adds a necessary and important element 
that may otherwise be beyond the current abilities of 
machine review, namely the subjective assessment of 
whether given content violates community standards, as 
compared with the objective assessment of where, when, 
and how that content was posted. For example, human 
review can pick up on nuances and can therefore allow 
permissible concepts such as parody, satire, and privacy 
interests to be incorporated into the evaluation process 
of taking an account down or confirming its authenticity. 
Facebook has over 35,000 employees dedicated to safety 
and security, including content moderation.’ 


Third, in addition to using both humans and machines to 
weed out the identifiable spoofed content from the platform, 
Facebook also provides users with account information so 
that they can independently verify pages or affiliations. 
For example, Facebook provides identity and geographic 
information about certain pages, so that if a page is owned 
or run by a foreign actor, the country location of the people 
or organizations managing the page is easily determined 
and, therefore, people can better assess whether the 
page they are engaging with is legitimate and authentic. 
Del. Aumua Amata Coleman Radewagen (R-AS) asked 
whether the platforms’ takedown and enforcement policies 
were at all informed by whether the scam was perpetrated 
by a non-state or a state actor.'°® Mr. Gleicher responded 
that the vast majority of fraudulent activities are committed 
by actors “motivated in order to make money” and when 
working to identify state-based actors Facebook has a 
number of strict controls to establish proof of association.'°? 
Facebook labels content from state-controlled media and 
is blocking advertisements from such outlets ahead of the 
U.S. election.'’”° 


According to Facebook’s written testimony, users sometimes 
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fail to disclose organizational control of their pages in 
order to make other viewers believe that the page is run 
independently.”' Mr. Gleicher also noted that Facebook 
prioritizes authentic engagement on its platform, and 
wants users to understand who is speaking to them and 
what perspectives are being represented.” Towards this 
end, Facebook has recently introduced a policy to deliver 
more accountability by requiring pages that are suspected 
of concealing or misrepresenting the page’s ownership to 
go through the formal business verification process and 
show more detailed ownership information in order to 
remain live on the platform.’ 


Fourth, Facebook has formed external partnerships with 
peer social media platforms, law enforcement agencies, 
and a group of third-party analysts (including academic 
researchers, think tanks, and governments), to study 
removed accounts for patterns of activity or identification 
data, and to more efficiently identify emerging or potential 
cross-platform threats. This is intended to create a more 
comprehensive understanding of vulnerabilities and 
deterrence strategies that can be deployed across the 
range of partners to more effectively combat foreign 
actors attempting to infiltrate the social media space. Mr. 
Gleicher noted that Facebook’s engagement with their 
external partners helped improve and refine the efficacy 
of their detection and enforcement techniques. Mr. 
Gleicher concluded, “By continuing to develop smarter 
technologies, enhance our defenses, improve transparency, 
and build strong partnerships, we are making the constant 
improvements we need to stay ahead of our adversaries 
and to protect the integrity of our platforms.” ' 


These new detection processes can be 
particularly helpful in identifying fraudulent 


accounts purporting to be some of the most 
frequently impersonated members of the U.S. 
military and veterans’ community. 





Mr. Gleicher also described efforts and progress in 
addressing inauthentic engagement on Instagram, which 
is owned by Facebook. For example, Instagram penalizes 
accounts that are associated with automated likes, 
comments, or follows to artificially expand their reach. 
Using machine learning and direct detection, the platform 
is able to “identify accounts that use third-party services 
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to distribute inauthentic engagement. When a service 
uses an account to generate inauthentic activity, our tools 
can detect and remove that activity before it reaches the 
recipient.” '”° Instagram also recently introduced the ability 
for community members to directly report scams discovered 
on the platform. As with Facebook, users are given more 
information about Instagram accounts with substantial 
followings so that users can make their own determination 
on the authenticity of the account. This information includes 
the date when the account joined Instagram, the country 
where the account is located, any username changes in the 
last year, and any ads the account is currently running. 


There have been several congressional inquiries into 
Facebook’s practices and policies in the aftermath of the 
2016 election, and Facebook has undertaken certain new 
measures to tighten its security and prevent similar abuse 
in 2020. Facebook noted that it is testing new detection 
capabilities that will help identify and remove accounts 
that impersonate real people using their names or images. 
These new detection processes can be particularly helpful 
in identifying fraudulent accounts purporting to be some 
of the most frequently impersonated members of the U.S. 
military and veterans’ community. The automated detection 
systems are trained to look for certain techniques used by 
scammers to impersonate individuals, such as omitting 
single letters of a person’s name to make the impostor 
account appear legitimate. Accounts that are flagged for 
potential impersonation during the automated review are 
then referred for additional human review. These processes 
are intended to help more quickly detect impostor accounts 
as soon as possible after creation and to remove them 
immediately upon review and human verification, often 
before people even see them. 


Accounts and pages that claim false affiliation or 
ownership with real organizations are unfortunately not 
limited to veteran-related groups. “In fact, the same bad 
actors sometimes create multiple pages, some of which 
may impersonate veterans’ organizations, while others 
might impersonate organizations that focus on politically 
sensitive issues. That is why, to root out and remove these 
bad actors, [Facebook] focuses on patterns of behavior, 
not just content.”'”° Facebook states that most removed 
accounts are blocked shortly after creation, stemming the 
reach of the account before it can do harm to other users 
or viewers. This approach allows Facebook to be flexible 
to combat various types of impersonation, and once 
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Facebook develops effective tactics with respect to one 
type of impersonation, they apply that tactic to other types 
automatically.'”” 


Facebook has told the Committee that it understands its 
responsibility to ensure users, including veterans, are 
protected from impersonation. Facebook also stated 
that it has established dedicated escalation channels 
for individuals and organizations most impacted by 
impersonation attempts, including the Department of 
Defense. However, in response to Rep. Jim Banks (R-IN) 
asking whether “Facebook hal[d] a specific process for 
reporting instances of veterans scamming to federal law 
enforcement agencies,” Mr. Gleicher did not provide any 
specific procedures or resources applicable to veterans.’ 


Is Facebook Doing enough? 


FACEBOOK HAS CONTINUED TO DRAW 
ATTENTION AND A MEASURE OF CRITICISM FOR 
its decisions to allow certain doctored content on its platform 
that some users decry as deliberately misleading or fake 
news. Compounding the problem, Facebook partners with 
third-party fact-checkers to assess the veracity of content 
and identify misinformation,”’ but defers substantially to 
the discretion of those external parties as to what content 
is actually fact-checked. Thus, even content that Facebook 
asserts is “eligible” to be fact-checked may not in actuality 
be examined unless a third-party partner specifically 
selects that content for review. The practical implication of 
this structure is that Facebook is able to shift accountability 
away from itself by pointing to its external fact-checking 
partners, but then it does not appear to provide sufficient 
guidelines on what content those partners must review — 
thereby significantly eroding the efficacy of its fact checking 
operations. Furthermore, Facebook has maintained its 
stated policy that political speech and opinions from 
elected officials, candidates or campaigns is not eligible for 
third-party fact-checking.'®° This seems to shift the burden 
of verification from the platform onto users themselves. 
It is questionable whether users have the awareness or 
means to authenticate accounts or verify content on their 
own. Moreover, because the social media platforms 
themselves have adopted vastly disparate policies in terms 
of accepting political advertisements, fact-checking, or 
identifying content that has been challenged, users face an 
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uneven and inconsistent social-media landscape, where it 
becomes significantly harder to determine reliability and 
trustworthiness. 


Facebook recently introduced an external, independent 
review appeals board that functions in a quasi-judicial 
capacity to review certain of Facebook’s content decisions 
and allow users to seek an additional layer of review for 
challenges to removed content.'*' However, it does not 
appear that this review board will have any access to 
authentication data for accounts or posts to help determine 
the legitimacy of users or content — but rather will function 
solely as the final arbiter of certain content moderation 
decisions. This is of decidedly less importance to the 
issue of spoofing and the distribution of disinformation or 
propaganda than it would be to potential claims of content 
standard violations such as decency / pornography claims, 
etc. 


Moreover, there is no appeals process that would enable a 
user such as VVA to elevate claims of a misappropriated or 
fraudulent account to a higher body for expedited review. 
During the October hearing, Rep. Gus Bilirakis (R-FL) noted 
the trouble that Mr. Goldsmith encountered in reporting 
and trying to take down the spoofed site.'** Mr. Goldsmith 
stated that he repeatedly and persistently sought to bring 
the spoofed VVA account to Facebook’s attention and still 
faced undue delays, a lack of transparency, and a lack of 
direct communication to help get the fraudulent account 
shut down expeditiously.'®° 


During the Committee hearing, Rep. Conor Lamb (D-PA) 
asked, “How much does Facebook spend on this specific 
problem set, in terms of paid employees, investments in 
the Al, and tech tools?”'®4 The response from Facebook 
was that on “the overall problem...[Facebook] hal[s] more 
than 35,000 employees working in this space. [Facebook] 
currently spend[s] more money today each year than the 
company made in profits the year that it IPO’d. Very, very 
large amounts.” '®° 


When Rep. Joe Cunningham (D-SC) posed a related 
question, Facebook stated that there are 35,000 
employees working on safety and security generally 
and this number is triple what it was a few years ago.'®° 
Rep. Lauren Underwood (D-IL) queried both Facebook 


79 Facebook, Fact-Checking on Facebook, https: //www.facebook.com/business/help/2593586717571940 2id=673052479947730. 
80 Facebook, Fact-Checking Program Policies, https: //www.facebook.com/business/help /315131736305613 2id=673052479947730. 
81 Josh Constine, Facebook's New Policy Supreme Court Could Override Zuckerberg, TECHCRUNCH (Sept. 17, 2019), https: //techcrunch.com/ 2019/09/17 /facebook-oversight-board/@guccounter=1. 
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and Twitter about the general timeline for someone who 
lodges a complaint to be able to communicate with an 
actual person, but neither company provided a definitive 
answer, noting instead that it depended on the specific 
circumstances and the manner of report.'®” 


The two primary areas in which Facebook has opportunities 
to do more to combat spoofing are verification of its own 
accounts and content and sharing more robust data with its 
peer platforms and law enforcement agencies. 


More stringent review or verification of authentication 
data for new accounts would directly help reduce spoofing 
by making it harder to create fraudulent or misleading 
pages. Facebook already imposes higher verification 
standards for pages and groups with large audiences.'®® 
Expanding that level of review for all accounts, and 
including geolocation information for owners, should be a 
feasible step.'®’ Although Facebook has outlined its efforts, 
investments, and initiatives designed to review and remove 
inauthentic content, it has notably excluded the significant 
category of political speech and opinion, including within 
paid advertisements, by candidates and campaigns from 
such processes.’”° Given the significant use of spoofing to 
seek to influence elections, political advertisements and 
communications are a prime opportunity for Facebook to 
adopt stronger enforcement practices. Facebook has made 
an incremental step in this direction by issuing a refined 
policy on political disinformation regarding the 2020 
election.” 


Similarly, sharing more comprehensive data about 
ownership, authentication, and activity patterns in 
instances of spoofing, fraud, or criminal activity would 
enable law enforcement and peer platforms to respond 
more efficiently and comprehensively in identifying bad 
actors.'”? Such measures would need to be carefully crafted 
to protect user privacy and civil rights concerns. Creating a 
law enforcement exclusion in the platform terms of service 
agreements for users could be a potential solution that 
balances privacy interests with law enforcement needs. 
Additionally, to the extent permitted within the existing 
legal structure, Facebook should increase the frequency 
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of notification and the scope of data exchanged with 
its peer platforms. Specifically, information related to 
fraudulent and removed accounts should be exchanged 
in order to facilitate identification and removal of related 
accounts on those other platforms. Facebook should 
also disclose more information about the frequency and 
nature of its communications with its peer platforms and 
law enforcement, including the scope and detail of the 
data that is shared about identified foreign infiltrators 
and spoofers.'* The efforts undertaken to increase 
transparency and responsiveness to complaints simply are 
not enough to prevent this threat from spreading, nor do 
the changes address the issues that VVA experienced in 
requesting removal of fraudulent pages. 


The efforts undertaken to _ increase 
transparency and_ responsiveness’ to 
complaints simply are not enough to 


prevent this threat from spreading, nor do 
the changes address the issues that VVA 


requesting removal of 
fraudulent pages. 


experienced in 


Twitter 


TWITTER IS A MAJOR AMERICAN SOCIAL MEDIA, 
NETWORKING, AND MICROBLOGGING SERVICE, 
with 186 million daily active users as of June 30, 2020." 
In his appearance before the Committee, and in response 
to a question from Rep. Andy Barr (R-KY), Twitter’s Public 
Policy Manager, Kevin Kane, said, “Every day there 
are more than 500 million tweets around the world on 
Twitter. And as | mentioned, we actioned approximately 
335,000 accounts that were permanently suspended 
that were engaging in scamming activity.”' On Twitter, 
users post and interact with brief written messages known 
as “tweets.” Tweets can also incorporate images, videos, 
links to articles, or other media into the messages. By 
redistributing (retweeting) messages broadly across 
subsequent networks, Twitter users amplify the messaging 
of the original tweet. Registered users can post, “like,” and 
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now-show-location-of-posts-from-high-reach-accounts-targeting-u-s-audiences/. 


189 Id. 
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retweet tweets, but unregistered users can only read them. 2009. Twitter encouraged open research and investigation 
of these datasets by researchers and academics in order 
How Twitter is Combatting Spoofing to identify potential behavioral patterns that might help 
improve deterrence protocols. Prior to the release of these 
IN THE AFTERMATH OF THE 2016 U.S. ELECTION, datasets, Twitter shared individual examples of alleged 
TWITTER RECEIVED SIGNIFICANT SCRUTINY foreign interference by the IRA in political conversations 
for the role it may have played in shaping and driving on the platform. Twitter also provided direct notice to any 
American political discourse and opinion, and particularly _ users if they had interacted with any of these state-backed 
with respect to the then-emerging idea of fake news and accounts. As stated by Mr. Kane, “[Twitter] launched 
misinformation.'”° this unique initiative to improve academic and public 
understanding of these coordinated campaigns around the 
In the fall of 2017, Twitter undertook an analysis of how world, and to empower independent, third-party scrutiny 
its platform, networks, and technology may have been of these tactics on our platform.”*°° 
deliberately manipulated by foreign actors for the purpose 
of influencing the election through the dissemination of Twitter continues to maintain a public archive of removed 
political propaganda or socially divisive content. The accounts. It claims that this archive is now the largest of 
analysis included both an investigation into activity its kind in the industry, and that thousands of researchers 
specifically by the Russian Internet Research Agency, and have used these datasets that contain more than 30 million 
a broader inquiry into all malicious automated activity individual Tweets and more than one terabyte of media.”” 
(posting, “liking,” or retweeting) originating in Russia. Twitter also periodically publishes new datasets of removed 
Twitter also reviewed a comprehensive collection of accounts (but not the underlying content) and without any 
election-related Tweets from accounts linked to Russia, associated signals data that would enable other platforms, 
and compared the activity levels of those selected accounts law enforcement, or analysts to trace activity from the 
to overall activity levels on Twitter.'*” Mr. Kane testified same foreign entities across platforms, or to other accounts 
that this analysis found 50,258 automated accounts on the same platform. Instead the currently available data 
that were Russian-linked and tweeting election-related represents isolated static snapshots of fraudulent accounts 
content, representing less than two one-hundredths of a_ that have already been removed by the time the data is 
percent (0.016%) of the total accounts on Twitter at the made available. 
time.'”? These accounts generated 2.12 million tweets, or 
approximately one percent of the total volume of election- Unfortunately, data included in the public archive is of very 
related Tweets, during that period. Twitter also analyzed _ limited practical use for law enforcement, analysts, or think 
accounts that paid for advertisements promoting election- tanks in terms of trying to predict future activity patterns 
related Tweets over the course of 2016 and discovered or understand foreign network breadth for prospective 
only nine such accounts with ties to Russia.'”” deterrence, and is similarly limited for other platforms 
seeking to identify and deter known actors before they are 
Upon identifying and isolating the account data associated able to infiltrate their own platforms.7°? Once an account 
with Russia’s Internet Research Agency (IRA), Twitter has been removed, important signal data like internet 
published a data set of removed accounts and underlying _ protocol (IP) address, geolocation, or timing of account 
data (e.g., message contents) that were from state-backed activity can no longer be used to actively trace where a 
foreign entities (including the IRA associated data). This user is operating from, what other accounts use the same IP 
data set has been studied by law enforcement, peer address, or whether accounts on other platforms share any 
platforms, and outside analysts, including Graphika. of the same signals data (which might indicate that a given 
user holds accounts on multiple platforms). 
Twitter released the full, comprehensive archives of 
Tweets and media associated with potential information Twitter maintains that it is restricted from sharing the 
operations found on the platform, including 3,613 accounts underlying content, even from accounts that have been 
believed to be associated with the IRA dating back to removed on the theory that the privacy protections under 
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its Terms of Service and Privacy Policy are extended even 
to fraudulent or removed accounts.” As part of the Terms 
of Service which govern Twitter’s relationship with its users, 
Twitter includes a written Privacy Policy.?™ The Privacy Policy 
lays out the terms and scenarios under which Twitter shares 
private user data with any outside parties, including third- 
party service providers, advertisers, and law enforcement. 
Private data includes any information that the user does 
not share publicly (e.g. direct messages or protected 
tweets), is not required to be shared for basic operation of 
Twitter (e.g. with service providers or advertisers), or is not 
otherwise authorized by the user. Twitter allows users to 
control when most of their own private data can be shared, 
but identifies certain exceptions including, notably, “law, 
harm, and the public interest.” Specifically, Twitter states 
that it may “disclose your personal data or other safety 
data if we believe that it is reasonably necessary to comply 
with a law, regulation, legal process, or governmental 


request.”*° 


In response to a request by Committee staff for data related 
to removed accounts, suspected bot accounts, and direct 
messages, Twitter explained that it requires legal process 
to turn over such information. Twitter further stated that 
under Title Il of the Electronic Communications Privacy Act 
(ECPA), also known as the Stored Communications Act,?°° 
legal process is required for the disclosure of all private 
data, and that any voluntary disclosure by Twitter without 
a specific legal requirement would violate its Privacy 
Policy.*” In the absence of any legal authority or statutory 
exemption specifically compelling the production of private 
data without a subpoena (even for law enforcement or 
regulatory purposes), disclosure from Twitter, other social 
media platforms, and internet service providers generally 
requires a time-consuming legal process that hampers 
the ability of law enforcement to use such data in an 
expedited manner to identify, obstruct, or apprehend the 
offenders. Although Twitter concedes that spoofing and 
misrepresentation violate its Terms of Service, it believes 
that its legal obligation to the user under the Privacy Policy 
continues in force even though the account may be removed 
for those violations. The specific legal question of whether 
Title Il of ECPA continues to protect data in cases of fraud 
or illegal activity is not clear based on legal precedent. 


203 HVAC Interview with Kevin Kane on October 17 2019. 
204 Twitter, Privacy Policy, httos://twitter.com/en/privacy. 
205 Id. 
206. 1B US. 8 270122715. 

207. 18 U.S.C. § 2702; HVAC Interview with Kevin Kane and Stacia Cardille on September 10, 2019. 


On October 30, 2019, Twitter announced a new global 
policy to stop all political advertising.*°° Twitter defined 
political advertising to include any paid messaging that 
references a candidate, political party, government official, 
ballot measure, or legislative or judicial outcome.*°’ The 
policy is based on the belief that “earned sharing” of 
political messaging (as measured by retweets and likes) 
is better and more organic than purchasing political 
advertising. Twitter Chief Executive Officer Jack Dorsey 
has stated that “paying for reach removes that decision, 
forcing highly optimized and targeted political messages 
on people.””'° Dorsey reasoned that targeted ads “present 
entirely new challenges to civic discourse: machine learning- 
based optimization of messaging and micro-targeting, 
unchecked misleading information, and deep fakes. All 
at increasing velocity, sophistication, and overwhelming 
scale.”*" Candidates, campaigns and parties are still able 
to share content, but they cannot simply extend the reach 
of that content through paid advertising. Twitter’s decision 
to ban paid political advertisements has been roundly 
commended. 


However, there are still loopholes which facilitate the 
promotion of political agendas without conflicting with the 
ad ban. Messages can be crafted around political issues 
without naming specific candidates, parties, or outcomes.” 
Additionally, while Twitter no longer allows for ads to be 
targeted as narrowly as by ZIP code, targeting based on a 
user's state or province is still possible." 


Mr. Kane further testified that Twitter has specific guidelines 
that govern a user's ability to share information about 
elections. He noted that users are prohibited from posting 
false or misleading information about how to participate 
in an election, including information about how to vote or 
voter registration, voter identification requirements, and 
the date or time of an election. Additionally, users may not 
attempt to intimidate or dissuade voters from participating 
in an election by sharing false or misleading information, 
including claims about polls being closed, long lines, 
voting equipment issues, votes not being counted, or law 
enforcement activity around poll sites. Finally, Mr. Kane 
also noted that Twitter does not allow “the creation of 
fake accounts which misrepresent their affiliation or share 
content that falsely represents its affiliation to a candidate, 
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elected official, political party, electoral authority, or 


government entity.”2" 


Is Twitter Doing Enough? 


TWITTER PROVIDED THE COMMITTEE WITH 
ONLY BROAD DETAILS ON HOW THE PLATFORM 
reviews content to screen for potential violations or 
coordinated activity. Twitter told Committee staff that it 
uses a layered review process similar to the one used 
by Facebook, incorporating both artificial intelligence/ 
automated machine review and human assessment. Content 
reported by users for potential violations of platforms is 
all reviewed by human content moderators, and there is a 
well-defined appeals process. 


In an exchange with Rep. Gilbert Cisneros (D-CA) during the 
hearing, Mr. Kane stated, “[Twitter] continues to invest and 
look at the behavior, look at the signals behind how these 
accounts are behaving and potentially targeting people, to 
include veterans. But again, we take a much more holistic 
approach so we are not just silencing certain communities, 
and we can apply lessons learned across the board. But 
again, it is looking at the signals behind the accounts, as 
well as potential coordinated behavior, which is a very 
strong signal that accounts are engaging in suspicious 
activity and cause us fo look into it further.”*" In response 
to a direct question from Mr. Cunningham, Twitter testified 
that it has devoted 4,700 persons to content moderation.7"° 
Ms. Underwood inquired specifically about the ability of a 
victim to engage content reviewers by telephone, but Mr. 
Kane noted that users are not able to do so presently.*” 


Twitter’s testimony about its internal investigative 
approach and how these complex, sometimes cross- 
jurisdictional operations are identified was presented in 
broad generalities that obscured the particulars of the 
type and scope of information that is shared with peer 
platforms and law enforcement (although it was repeatedly 
mentioned that such cooperation and collaboration does 
occur). Twitter recognizes that, as a private company, 
there are threats that it cannot understand and address 
alone. Twitter has disclosed that it participates in regular 
discussions with law enforcement and other platforms, 
including quarterly briefings with FITF on foreign influence. 
Twitter also meets monthly with representatives from FBI, 
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DHS, ODNI, DOJ, and industry peers to discuss 2020 
election threats. Starting in 2018, a number of technology 
companies — including Twitter — established a dedicated, 
formal communications channel to facilitate real-time 
information sharing regarding election integrity, and 
Twitter continues to utilize that communications channel for 
ongoing information sharing. Twitter did not provide any 
details on the nature or scope of data exchanged, or other 
systemic details.2'® Nor did Twitter’s testimony describe 
the nature of the communications between Twitter and its 
peers or law enforcement, and the scope and detail in the 
data that is shared about identified foreign infiltrators and 
spoofers.””’ The lack of data sharing represents a significant 
impediment to determining when foreign-based actors 
might be launching infiltration attacks across multiple 
platforms, or to anticipate such attacks in a timely manner 
to effectively minimize potential harm. 


Twitter continues to monitor and enforce political accounts 
for compliance with its Rules on Platform Manipulation. 
This was recently enforced against the campaign of 
Michael Bloomberg in the Democratic primaries, resulting 
in the suspension of seventy accounts for coordinated 
behavior.”*° However, opportunities remain for spoofers 
to exploit gaps between these policies, for example, by 
using divisive content that does not meet the threshold of 
paid political advertising, but serves similar purposes. For 
example, Twitter still allows ads related to social causes 
such as climate change, gun control, and abortion, but 
organizations cannot advocate for or against a specific 
political, judicial, legislative, or regulatory outcome related 
to those matters.?7' 


Given that there are strict restrictions on the ability of foreign 
actors to contribute to or coordinate with U.S. political 
campaigns, either the platforms must monitor themselves 
or empower federal regulators to police the platforms 
for potential violations of U.S. election laws. Both Twitter 
and Facebook acknowledged in their comments to Mr. 
Cunningham that they report their findings and takedowns to 
the Federal Election Commission and the Federal Bureau of 
Investigation, when the offending patterns of activity might 
indicate foreign efforts to influence political messaging or 
elections. Twitter published a report of its findings from 
the 2018 U.S. midterm elections. The 2018 U.S. midterm 


elections were the most Tweeted-about midterm election in 


220 Meryl Kornfield, Twitter Suspends 70 Pro-Bloomberg Accounts for Campaign's Copy-and-Paste Strategy, THE WASHINGTON POST (Feb. 22, 2020), https://www.washingtonpost.com/ politics / 2020 /02/22/bloomberg-twitter- 


suspensions /. 


221 Emily Stewart, Twitter Is Walking into a Minefield with Its Political Ads Ban, VOX (Nov. 15, 2019), https://www.vox.com/recode/2019/11 /15/20966908 /twitter-political-ad-ban-policies-issue-ads-jack-dorsey. 


HIJACKING our HEROES The Social Media Plattorms | 28 


history with more than 99 million Tweets sent from the first 
primaries in March through Election Day.?”? 


We must empower veterans with the 
information necessary to make an informed 
choice about whether the benefits of social 


media are worth the risks and to make them 
aware of available resources to protect 
themselves. 

- Ranking Member Dr. David P Roe 


Twitter previously offered a “verified user” feature which 
allowed certified authentic accounts to be identified with a 
blue checkmark next to their posts. The verification feature 
has now been suspended for new users with a few narrow 
categories of exceptions, such as celebrities, journalists, 
and public officials. Twitter has said that it is committed 
to verifying VSOs, but the reality is that it is still difficult 
for these organizations to receive verification. Even a 
Congressionally chartered VSO such as VVA experienced 
difficulties and delay in trying to get a verified account. As 
Mr. Goldsmith noted during his testimony, the only reason 
that VVA was able to ultimately obtain a verified account 
on Twitter was because he facilitated the request through 
a personal relationship with a Twitter employee.?”° Twitter 
has informed HVAC that all VSOs with Twitter accounts 
have now been verified, and has committed to working with 
the committee to ensure that congressionally-chartered 
VSOs, and their affiliated chapters, continue to be verified. 
As foreign spoofers become more sophisticated in their 
ability to impersonate or imitate legitimate accounts and 
users, each individual piece of available signals data 
becomes more valuable in the effort to identify digital 
fingerprints in order to efficiently intercept (if not prevent) 
such attacks. While it is unclear what data it may provide 
through private channels to other platforms or to regulators, 
222 Mr Kane written testimony, at 4. 


223 HVAC Committee Hearing Transcript, at 55. 
224 Id. at 10. 





Twitter’s compliance with the procedures required under 
Title Il of ECPA before releasing data to the broader public 
presents an impediment to combatting foreign spoofing 
in an efficient and timely manner. Ranking Member Dr. 
David P. Roe stated, “ We must empower veterans with the 
information necessary to make an informed choice about 
whether the benefits of social media are worth the risks 
and to make them aware of available resources to protect 
themselves.”?”4 


Twitter should restore its verification process for accounts 
so that users are able to quickly and easily discern which 
accounts have been reviewed and vetted. Additionally, 
Twitter should disclose information about the nature and 
frequency of its communications and data sharing with 
its peer platforms and with law enforcement. Importantly, 
Twitter should support a revised process by which data 
tied to inauthentic or criminal behavior can be efficiently 
and adequately shared with other platforms and law 
enforcement so that spoofers are not able to jump from 
platform to platform to elude enforcement. However, all 
such data sharing measures must be designed to balance 
and protect users’ privacy interests as well. 
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The ROLE of LAW ENFORCEMENT 


Briefing with the Committee 





ON JANUARY 14, 2020, REPRESENTATIVES FROM from pensions, annuities, and VA benefits payments. The 
THE FBI BRIEFED COMMITTEE MEMBERS AND other sections chiefs also acknowledged the serious threats 
STAFF ON THE GROWING ISSUE OF SPOOFING | that veterans face from a multitude of spoofing attacks, 
targeting veterans. The meeting was bipartisan and on-the- ranging from romance scams to commercial fraud to 
record.”*° FBI participants were drawn from the Foreign replicated websites being used to advance misinformation 
Influence Task Force (FITF) and the Criminal Investigative campaigns. 

Division (CID), including CID staff of the Money Laundering, 
Forfeiture, and Bank Fraud Section, the Financial Crimes 
Section, and the Economic Crimes Unit. Section Chief Brad 
Benavides of FITF and Acting Deputy Assistant Director 


Threat Evaluation and Statistics 


eo. Mac ce Cin Ai neq, THE OVERALL VOLUME OF INTERNET CRIME 
teve Merrill of CID, the two senior members of the ¢ompLAINTS IS A STAGGERING $3.5 BILLION IN 


panel, provided the majority of the comments on behalf 
of the FBI. CID handles the FBI’s efforts to identify, deter, 
and disrupt significant complex financial, health care, 
money laundering, and intellectual property crime threats 
impacting the United States. The FITF is a multi-divisional/ 
multi-agency task force comprised of agents, analysts, 
task force officers, and professional support focused on 
combating malign foreign influence efforts targeting the 
United States. The CID is “the largest major division in the 
Bureau, supporting more than 4,800 Special Agent{s]. 
Within this division, the emphasis is on preventing crimes 
related to national security, such as interrupting financial 
networks that provide support to terrorist organizations. 


A large number of personnel are also allocated to violent 
226 


aggregate annual losses, which includes the categories of 
commercial fraud, international campaigns, and romance 
scams. FBI representatives described a massive increase 
in romance scams, which notably grew from $211 million 
in 2017227 to $362 million in 2018228 and to $475 million 
in 2019.27? The scale of the problem is likely even larger 
than those numbers might suggest because the FBI noted 
that these scams are often underreported due to victims’ 
embarrassment or reluctance to disclose to their families 
that they have been scammed or lost money.?°° 


Putting the threat to veterans in perspective, Ranking 

Member Roe asked the law enforcement representatives 

about the effectiveness of these spoofing schemes. The 

FBI stated that spoofing is effective because, put simply, 

it works and that is precisely why malign actors use it as a 

mu 7s , “pe technique. The FBI representatives mentioned that one of 

the surest ways to limit the reach of spoofers is to improve 

cyber-hygiene, or the practices and precautions that users 

of computers and social media should take to maintain 

a system health and improve online security. These practices 

are often part of a routine to ensure the security of identity, 

maintenance of privacy, and protection of personal data 

including financial or identity details.2°' Examples of such 

practices include keeping passwords secret, not divulging 

banking or credit card information carelessly, and being 
vigilant for attempted impersonation. 


crimes, financial crimes, and organized crime. 


Both FITF Section Chief Benavides and Acting Deputy 
Assistant Director of CID Merrill used their opening remarks 
to highlight the target rich environment that an aging 
veteran demographic provides for potential criminals. CID 
emphasized that veterans are attractive targets for financial 


oo. ; On the issue of investigating foreign actors seeking to 
exploitation and scams due to their steady income streams 


distribute political propaganda or influence American 
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elections, the FBI relies upon the Foreign Agent Registration 
Act (FARA) for authority and access to investigative tools 
to pursue these perpetrators and networks overseas. The 
specific tools, however, are not available in matters that do 
not involve foreign actors, and therefore the FBI must rely 
on a range of less effective strategies to investigate and 
eliminate other forms of spoofing, including the voluntary 
sharing of data by the social media platforms and 
anecdotal reports of potential fraud. Although CID and 
FITF have responsibilities for different aspects of spoofing, 
and consequently have access to different tools, both 
agencies agreed on the importance of receiving data and 
information regarding potential crimes in a timely manner. 


Both CID and FITF also noted that one of the most effective 
tools to eliminate inauthentic online behavior including 
spoofing, is the Terms of Service (TOS) implemented 
by the respective platforms for their users. Violations of 
those terms by bad actors, through impersonation, spam, 
fraud, intellectual property violations, or other prohibited 
conduct, enables the platforms to suspend or terminate 
the offending accounts, and to remove content from the 
platform archives in certain cases. Enforcement of the TOS 
by the platforms is the most efficient and expeditious way 
to remove violators and their content from a given platform 
because the platform is the ultimate arbiter of its own rules, 
and such enforcement does not require the participation of 
law enforcement. 


However, when a violation of TOS may also involve 
criminal activity, such as fraud or actions by a foreign 
actor, the FBI strongly emphasized the need for 
immediate communication between the platforms and law 
enforcement. The FBI representatives specifically noted the 
importance of quickly sharing the details and underlying 
identification data about the accounts undertaking the 
spoofing or fraud when the platforms take down such 
accounts. The FITF representatives further suggested 
that when social media companies identify inauthentic 
behavior on their platforms, they should immediately 
notify and engage law enforcement before taking down 
the offending accounts. Mr. Benavides stated that this 
would allow the FBI to monitor, trace, observe and gather 
relevant data from the active accounts, which will directly 
assist in tracing foreign networks, individual accounts 
across platforms, or specific bad actors running multiple 
accounts. None of these outcomes would be feasible if law 
enforcement is only apprised after the fact (i.e., after the 
platforms have already taken down the bad accounts). In 
the absence of sharing such contemporaneous notice and 
underlying data, the FBI noted severe limitations on its 
ability to retroactively investigate or identify bad actors, let 
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alone develop more robust systems or tools for intercepting 
such campaigns in the future. 


Communications and Data Sharing 


WHEN CHAIRMAN MARK TAKANO ASKED 
ABOUT THE CURRENT NATURE AND SCOPE OF THE 
engagement with the platforms, the two FBI components 
described starkly different relationships with the platforms. 
Section Chief Benavides described what he considers to 
be a strong working relationship and general satisfaction 
with the social media firms. FITF holds standing quarterly 
meetings with social media companies, which cover a 
broad range of topics covering inauthentic behavior on 
the platforms, including spoofing, spamming, and bot 
activity. He described the relationship as positive because 
the voluntary free flow of information that FITF enjoys 
allows his section to assess and work through threats with 
social media companies. Section Chief Benavides felt that 
the voluntary information exchange provides for a better 
working relationship as opposed to social media companies 
providing information on an ad hoc request-by-request 
basis. Mr. Benavides reasoned that the informal working 
relationships that develop between FITF personnel and the 
enforcement teams at the social media platforms facilitates 
a more robust discussion of issues that would perhaps 
otherwise not rise to the threshold of a formal reporting 
requirement or an actual legal violation. This unstructured 
discussion of potentially suspect activity, instead of the 
higher bar of actual crimes or specific conduct, enables 
FITF to engage the social media platforms earlier than 
might be feasible in a more formal reporting environment. 


On the other hand, the CID’s Financial Crimes team noted 
much less satisfaction with its current relationships with the 
social media platforms and drew a marked contrast between 
those relationships and the one that CID enjoys with the 
highly regulated banking sector. CID described numerous, 
regular contacts held between the FBI (in conjunction with 
the Department of the Treasury) and the banking sector. 
The relationship and communications between the FBI and 
the banking sector include quarterly national meetings 
with the big banks and financial institutions. Furthermore, 
the FBI headquarters in Washington D.C. encourages each 
of the 56 field offices to engage directly with financial 
institutions in their respective territories. Unlike FITF, CID 
does not have any such regularly scheduled meetings with 
the social media platforms. 


CID often receives information about social media incidents 
informally through individual relationships between people 
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at social media companies and FBI personnel, which is reticence toward creating a statutory obligation for 
generally less helpful than the formal, systematic reporting reporting or standards because such an endorsement 
structure in place with the financial sector. The most notable might jeopardize the current relationships and voluntary 
source of reporting about online fraud is from the victims information exchanges, or inadvertently create a higher 
who have lost money themselves and report directly to CID, triggering threshold before formal reporting is required 
rather than from the social media companies. The piecemeal than is currently enjoyed — specifically by the FITF. 
anecdotal information creates a lack of uniformity in However, both components agreed on the importance 
timing, detail, and data. This, in turn, hampers the ability of timely communications and access to comprehensive 
of CID to form a systemic understanding of the problems or data. So, while a mandatory reporting structure may 
solutions, and from synthesizing aggregate data that could not be advisable, any measures aimed at facilitating law 
potentially be used to identify patterns, trace networks, enforcement’s access to data in an expedited manner 
or otherwise develop comprehensive defensive protocols. would greatly enhance their ability to identify and isolate 
Particularly with respect to fraud or financial crimes, potential criminals. 
reliance on anecdotal evidence also prevents CID from 
understanding the full scale of potential crimes because CID also recommended aggregation of the data being 
they cannot accurately compile aggregated data without reported and explained that in the banking industry 
detailed information from the platforms themselves. there are “suspicious activities reports” prepared for and 
provided to the Department of the Treasury, which then 
Relying on individual victim reports cannot substitute forthe shares that information with the Financial Crimes Section. 
more comprehensive information that would be available That mechanism can be used as a model to aggregate and 
from the platforms. Asa result, CID described its ownactions report data on fraud in the social media arena. There is 
as generally reactive, instead of proactive, due to this lack a mandatory centralized repository of data for banking 
of detailed, aggregated information and formal reporting reports, and it would be very beneficial if CID had access 
of suspected criminal activity. If a platform takes down to a comparable system containing reports from social 
certain accounts, CID is only made aware of such action if media platforms. This would be a significant departure 
the platform voluntarily notifies it — there is no alternative from the current practice in which CID only sporadically 
way for CID to track that information independently. Broad learns about fraudulent activities through anecdotal victim 
categories of platform takedowns should arguably trigger reports, which are notably underreported, supplemented 
automatic reporting, for example, when a platform acts in _ by irregular voluntary communications from the platforms 
response fo criminal activity such as fraud or child-welfare themselves. In response to a question about potential 
issues, but even those disclosures are currently voluntary. mandatory reporting requirements for social media 
Additionally, CID noted that it cannot know what additional companies, CID representatives indicated that when the FBI 
details the social media companies might be withholding prosecutes someone successfully, it announces it because 
from disclosure. For example, platforms may be reticent _ it is important for the public to be knowledgeable about 
to divulge additional details that might expose platform enforcement actions on the social media platforms and the 
vulnerabilities until after the platform is able to address consequences of perpetrating fraud. However, due to the 


such vulnerabilities. mutually beneficial relationship experienced by the FBI 
and social media platforms, the representatives generally 
Is Law Enforcement Doing Enough? expressed desire to continue the current voluntary 


information exchange rather than potentially jeopardize 


THROUGHOUT THE DISCUSSION THE PANEL the existing streams of information. 

DISCUSSED THE LACK OF LEGISLATIVE OR 

statutory disclosure requirements. Law enforcement relies The CID representatives noted that their work with the 
almost entirely on social media platforms’ voluntary banking sector could be used as a model for creating a 
disclosures and cooperation to take down actors conducting better formal working relationship with the social media 
spoofing operations. While the two components, FITF companies. A similar combination of regular meetings, 
and CID, were split in their current satisfaction with the along with an agreed upon protocol for reporting the 
level of cooperation and communication received from discovery of fraud or criminal activity and information 
the social media platforms, both were also hesitant to related to removed accounts, would be an advisable 
recommend potential changes to the statutory framework. addition to the current working relationship between CID 


Representatives from both FITF and CID expressed some Nd the social media platforms. CID emphasized that these 
changes to the current operating procedures regarding 
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notification, reporting, data exchange, and communication 
between the social media companies and the FBI would 
increase the division’s effectiveness, ability to prosecute, 
and deterrence of spoofing incidents. Interestingly, given 
the significant disparities in how the social media platforms 
communicate and exchange information with CID as 
compared to FITF, it appears that much of this problem is 
simply based on the internal policies of the social media 
platforms, rather than rooted in any systemic obstacle. 


When considering potential improvements to address 
spoofing issues and the threats they pose to veterans, the 
FBI panel had five recommendations: 


1. Create a standard of aggregation for both reported 
violations of the terms of service (TOS) and 
unreported (but acted upon) violations of TOS; 


2. Establish a universal, industry-wide standard for 
releasing detailed data from account takedowns, 
and facilitating access for law enforcement to 
obtain such data in a timely manner; 


3. Improve the communication by social media 
platforms of suspicious activities to federal law 
enforcement prior to takedown in order to enable 
social media platforms and law enforcement to 
work in tandem to address spoofing threats and 
identify foreign networks; 


4. Establish a standard for reporting suspected 
spoofed accounts/ pages to law enforcement prior 
to removing or taking down the accounts/ pages; 
and 


Di: Start an education campaign in the form of Public 


Service Announcements on cyber-hygiene or some 
other combination of efforts. 
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THE COMMITTEE’S REVIEW OF THE THREAT POSED 
BY INTERNET SPOOFING TO OUR VETERANS HAS 
revealed that the issue is a complex one, with ramifications 
extending well beyond the veterans themselves to include 
their families, communities, and ultimately the nation itself 
through attempts to influence our elections. Spoofing has 
many manifestations, and through the ubiquity of social 
media the potential reach of spoofers is growing. As social 
media networks have expanded their reach and diversified 
their platforms, new opportunities have arisen for bad 
actors to leverage this technology to perpetrate scams and 
misappropriate veterans’ voices and images for malicious 
purposes. Chairman Mark Takano noted, “Manipulation 
of social media networks, a major source of news and 
information, has become a tool of influence.”?°? 


Of importance is that a substantial number of these bad 
actors are based in other countries, where some are even 
acting at the behest of state-backed entities. Rep. Andy 
Barr (R-KY) stated it plainly by saying, “We are very 
concerned about scams and fraud schemes targeting our 
veterans coming from overseas, foreign entities.””°° Foreign 
manipulation of social media networks for the purposes of 
spreading disinformation, sowing division, and influencing 
our political elections is a clear, present, and growing 
threat facing the veterans’ community. This was an ongoing 
concern during the 2020 election year, as the lessons of 
foreign influence in the 2016 election still linger. 


Regrettably, the Committee also learned about significant 
shortfalls in the efforts and abilities of the social media 
platforms to detect, deter, and prevent such spoofing and 
manipulation. There is no doubt that the major social media 
platforms have developed global footprints which enable 
people from all walks of life to quickly and easily connect 
with friends and family, access news reports, financial 
services, and commercial interactions. But the global reach 
and ease of access also makes social media platforms 
particularly valuable to spoofers seeking to efficiently, 
cheaply, and surreptitiously encroach upon unsuspecting 
users, particularly when veterans believe that they are 
interacting with a fellow veteran. 


Facebook and Twitter, two of the most significant and 
influential social media platforms, testified before the 
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Committee and described the extensive resources that they 
are devoting to studying, detecting, and deterring spoofers. 
Both platforms noted the huge numbers of accounts they 
have closed, the volume of content that has been removed, 
and their work with outside analysts and cybersecurity 
experts to tighten their platforms against future infiltration. 
However, notwithstanding these efforts, Dr. Barash of 
Graphika testified that the data shows steadily increasing 
rates of spoofing — indicating that spoofers are outpacing 
the platforms’ efforts to curtail the problem. The platforms 
noted specific challenges in addressing inauthentic 
behavior quickly and comprehensively, including the need 
for multiple levels of review to combine automatic detection 
of certain suspicious activity patterns with subjective human 
review that can accommodate protected usage like satire or 
tribute. Ultimately, neither social media company was able 
to provide a definitive answer as to how or when spoofing 
could be effectively eliminated from their platforms. 


We are very concerned about scams 
and fraud schemes targeting our veterans 


coming from overseas, foreign entities. 
— Representative Andy Barr 





Representatives of the FBI echoed the concerns about 
a rapidly-evolving threat capable of learning how to 
circumvent or defeat preventative measures put in place 
by the social media firms, and described the difficulties in 
tracing spoofed accounts back to individual bad actors 
or foreign networks without closer collaboration between 
federal law enforcement and the platforms. Drawing 
parallels to the existing reporting requirements in the 
banking industry, the FBI articulated a need for greater 
communication between the platforms and law enforcement 
with a particular emphasis on early notification that would 
allow the FBI and its partners to act proactively to identify 
and even intercept bad actors before they are simply able 
to reappear online under a different name, profile, or 
guise. The proliferation of online threats and the presence 
of foreign entities seeking to exploit veterans in order to 
pursue illicit gains or disrupt American elections demands 
immediate attention, and Congress can help bridge the 
existing gap between the social media platforms and the 
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law enforcement community. 


The law enforcement agencies largely rely on voluntary 
disclosure of data by the platforms. The agency 
representatives described the potential for protracted 
delays while pursuing legal process in order to obtain 
specific data that the platforms do not voluntarily share. 
Moreover, some of the FBI representatives expressed 
concern that a system of mandatory data sharing might be 
counter-productive if it resulted in the platforms only sharing 
the specific mandated data in lieu of the broader, more 
informal and transactional exchanges currently in place. 
Therefore, options to expand the scope and feasibility 
of voluntary data disclosures appear to be the preferred 
course of action to improve law enforcement efficiency. 
For example, the existing ECPA provisions for voluntary 
disclosure of customer records and communications (18 
U.S.C. § 2702) already allow the platforms to provide 
certain communications information to law enforcement 
under narrowly defined circumstances in §2702(b), but 
stop short of allowing voluntary disclosure of the type 
of identifying account information that would be most 
useful in assessing and apprehending potential criminals. 
The subsequent subpart, §2702(c), which relates to the 
voluntary disclosure of customer records (which would 
include the relevant identifying account information) does 
not include corresponding language to allow provision 
of these records to law enforcement. Aligning the scope 
and nature of data available to law enforcement through 
the voluntary disclosures authorized under the different 
subsections of Title Il of ECPA could be one way to 
potentially enable the FBI to efficiently access the most 
relevant data it needs for its enforcement work while 
maintaining strong privacy protections and a voluntary 
structure for information sharing. 


Notably, there are relevant provisions compelling the 
mandatory disclosure and sharing of certain protected 
financial information in cases of terrorist financing, money 
laundering, and other criminal conduct, which could 
serve as a model for a more formal approach to data 
sharing with social media platforms, should the voluntary 
disclosure approach prove ineffective. While spoofing 
alone would not be likely to trigger any criminal laws (short 
of commercial scams that could constitute wire fraud), 
mandatory information sharing could be facilitated by the 
agencies or required through a change in statute. However, 
as noted by the law enforcement representatives, there are 
significant reasons for preferring voluntary disclosures, 
and so an expansion of such voluntary disclosure authority 
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should be the recommended approach. 


Congress must consider the best way to facilitate a timely 
exchange of detailed information that will enable the 
social media platforms to honor their privacy commitments 
to their users, while also positioning and equipping law 
enforcement with the data it needs to identify and eliminate 
foreign actors preying on unsuspecting Americans. 


Moreover, Congress has an opportunity to help educate 
the millions of users of social media, including veterans, 
about the lurking threats posed by spoofers online. As 
Ranking Member Roe observed, “We want to shed light 
on the issues impacting veterans, help them understand the 
risks associated with using social media, and direct them to 
resources to empower them to protect themselves and their 


families online.” 2°4 


The data and analysis reviewed by the Committee 
demonstrate that foreign attacks continue to proliferate, 
while it does not appear thatthe platforms have implemented 
adequate improvements to prevent spoofing preemptively. 
In conjunction with greater alignment and communication 
between the social media platforms and law enforcement, 
educating veterans and the broader public about the threat 
of spoofing is an appropriate and measured response to 
helping protect our veterans and broader society. 


As Chairman Takano laid out in the Committee hearing, 
“Social medial platforms play an important role in public 
discourse, and | continue to believe in protecting our 
freedoms of speech and innovation. But there is a very 
real and growing problem here, and we need to determine 
how to strike the balance between shielding platforms 
from frivolous lawsuits and ensuring election security and 
sanctity of our veterans’ voices in civic discourse. The 
platforms themselves need to do more to eliminate the issue 
of internet spoofing, and if they don’t, then Congress will 
need to step in more directly.”°° 


Congress must consider the best way to 
facilitate a timely exchange of detailed 
information that will enable the social media 
platformstohonortheir privacy commitments 


to their users, while also positioning and 
equipping law enforcement with the data 
it needs to identify and eliminate foreign 
actors preying on unsuspecting Americans. 
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RECOMMENDATIONS 





RECOMMENDATIONS AND SOLUTIONS TO THE THREAT OF INTERNET SPOOFING FALL INTO TWO 
BROAD CATEGORIES. THE FIRST CATEGORY IS ORIENTED AT USERS OF SOCIAL MEDIA AND IS 
defensive in nature, such as teaching users how to be aware of the dangers posed by spoofers on social media and 
training them how to protect themselves through heightened vigilance, healthy skepticism, and adherence to basic 
principles of cyber-hygiene. The second category is aimed at putting the social media platforms and law enforcement 
on the offensive and developing robust mechanisms to more effectively identify and eliminate foreign-based spoofers 
quickly. While the first category is likely to be less costly and easier to implement, the second category may ultimately 
prove to be more effective in bringing the threat under control. 


Improve Awareness 


1. IMPROVE AWARENESS THROUGH A PUBLIC SERVICE ANNOUNCEMENT CAMPAIGN - As 
noted by several Committee Members, FBI representatives, and testifying witnesses, the problem of spoofing 
is exacerbated by a general lack of public awareness of the issue and unfamiliarity with how to assess 
online content in order to evaluate authenticity. Warnings of the risk that social media content may not 
actually be from legitimate sources or be deliberately planted for exploitative purposes can be effectively 
and efficiently communicated through a public awareness campaign, such as through public service 
announcements (PSA). These public awareness campaigns can be distributed through the social media 
platforms themselves, or more comprehensively through other media outlets and agencies, such as VA. 


2. DEVELOP CYBER-HYGIENE TRAINING -— VA and the Department of Defense should develop robust and 
comprehensive cyber-hygiene training. This would go beyond the basic information provided by public awareness 
campaigns. For example, agencies could provide training on best practices in protecting personal and financial 
information, how to read and review content online with an eye towards verification, and how to engage the 
platforms themselves when needed to remove spoofed accounts, fraudulent posts, or other deceptive content. 


3. STRENGTHEN PARTNERSHIPS BETWEEN SOCIAL MEDIA PLATFORMS AND VSOs - Astrong partnership 
could include an ongoing process for VSOs to contribute their expertise and familiarity to assist the social media 
platforms in their efforts to address spoofing. The social media platforms noted that it can be difficult to differentiate 
legitimatecontentfromveteransorVSOsfromspoofedcontentpurportingtobefromtheveterans’ community. Thereare 
ampleresourceswithinthebroaderveterans’ communitytohelpadviseandconsultwiththeplatformsonsuchquestions. 


Strengthen Prevention and Enforcement Methods 


4. IMPROVE REVIEWS OF ACCOUNTS BY SOCIAL MEDIA PLATFORMS - The social media platforms should 
implement stronger reviews of accounts that pose substantial risk of spoofing. This should include the adoption 
of industry-developed best practices involving accounts that control groups or pages with very large reach in 
order to closely scrutinize activity on these groups or pages to quickly identify potential patterns of suspicious 
behavior. Given the influence and reach, any such groups or pages that meet or exceed certain thresholds 
of followership should have their controlling accounts be officially verified by the social media platforms, and 
the details of such verification (ownership, geolocation, moderators, etc.) be publicly available for all users. 


5. CONSIDER LEGISLATIVE REFORMS TO FACILITATE SHARING INFORMATION - Congress should 
consider appropriate modifications to the federal laws that currently limit the social media platforms’ ability to 
freely share data with law enforcement agencies or other peer platforms in order to detect, prevent, or remove 
fraudulent or spoofed content in a timely and efficient manner. Federal law is murky on how the privacy rights of 
users intersect with law enforcement needs with respect to data or identification information in cases of potential 
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illegal activity or fraud. The platforms have generally erred on the side of maintaining user privacy in the absence 
of a clear legal requirement to provide such data to law enforcement agencies. However, there are certain 
inconsistencies in the existing laws governing voluntary disclosures to law enforcement which contribute to 
challenges and delays. Congress could align the scope of voluntary disclosure of information to law enforcement 
under the respective provisions of Title Il of ECPA to facilitate greater transparency and timely information sharing 
with law enforcement. This would essentially allow holders of electronic communications and records to voluntarily 
release the data associated with fraudulent, spoofed, or misappropriated accounts to law enforcement agencies 
and potentially also to their enforcement counterparts at peer platforms, when criminal activity or other imminent 
harm is reasonably suspected. However, any new legislation in this area or any change to the ECPA statute must be 
both narrow in scope and include strong safeguards to protect the personal privacy and civil rights concerns of users. 


6. INCREASE DATA SHARING ON FRAUDULENT ACCOUNTS - Social media platforms should improve 
their sharing of identified fraudulent and spoofed accounts with other platforms and law enforcement to the 
extent permissible under current statutes, both in terms of frequency of sharing and the scope of the data 
that is shared. Although ECPA protects underlying identifying information, there is other information about 
spoofed accounts that can still be shared. Increasing the scope and timeliness of shared information pertaining 
to accounts that have been identified, and likely removed as fraudulent or spoofed, would enhance cross- 
platform detection. Additionally, consistent protocols could be established around communication between the 
platforms and law enforcement, and amongst the platforms, to ensure that information is shared on a regular 
and timely basis, rather than only in response to crises or incidents. This sharing of information should be 
narrow in scope and include strong safeguards to protect the personal privacy and civil rights concerns of users. 


7. IMPROVE IDENTITY VERIFICATION AND GEOLOCATION IDENTIFICATION - Social media platforms 
should improve their verification of identities, affiliations, and geolocation for all accounts. This would create a 
consistent and more robust version of the verification and checkmark system that was previously employed in 
various permutations by Twitter and Facebook. This would make it more difficult for foreign actors to disguise 
or misrepresent their locations and consequently their identities). The geolocation and account ownership 
information should then be readily available to users and to law enforcement, to increase transparency and 
foreclose intentional concealment of where an account is based. 
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